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Abstract 

We focus on a family of quanfum coin-flipping protocols based on quanfum bif-commifmenf. 
We discuss how fhe semidefinite programming formulafions of cheafing sfrafegies can be re¬ 
duced to optimizing a linear combination of fidelify funcfions over a polyfope. These torn 
ouf to be much simpler semidefinite programs which can be modelled using second-order cone 
programming problems. We then use these simplifications to construct their point games as de¬ 
veloped by Kitaev by exploiting the structure of optimal dual solutions. 

We also sfudy a family of classical coin-flipping profocols based on classical bif-commifmenf. 
Cheafing sfrafegies for fhese classical profocols can be formulated as linear programs which are 
closely relafed fo fhe semidefinife programs for fhe quanfum version. In facf, we can consfrucf 
poinf games for fhe classical profocols as well using fhe analysis for fhe quanfum case. 

We discuss fhe philosophical connections between fhe classical and quanfum profocols and 
fheir poinf games as viewed from optimization fheory. In particular, we observe an analogy 
befween a specfrum of physical fheories (from classical fo quanfum) and a specfrum of con¬ 
vex opfimizafion problems (from linear programming fo semidefinife programming, fhrough 
second-order cone programming). In fhis analogy, classical systems correspond fo linear pro¬ 
gramming problems and fhe level of quanfum feafures in fhe sysfem is correlafed fo fhe level 
of sophisfication of fhe semidefinite programming models on the optimization side. 

Concerning security analysis, we use the classical point games to prove that every classi¬ 
cal protocol of fhis type allows exactly one of fhe parfies fo entirely determine fhe coin-flip. 
Using fhe infricafe relationship befween fhe semidefinife programming based quanfum proto¬ 
col analysis and fhe linear programming based classical protocol analysis, we show fhaf only 
"classical" profocols can safurafe Kifaev's lower bound for sfrong coin-flipping. Moreover, if 
fhe producf of Alice and Bob's optimal cheafing probabilities is 1/2, fhen exacfly one parfy can 
perfecfly confrol fhe oufcome of fhe profocol. This rules ouf quanfum profocols of fhis t 5 rpe 
from affaining fhe opfimal level of securify. 
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1 Introduction 


Security levels of quantum coin-flipping protocols as well as classical coin-flipping protocols can 
be modelled and analyzed via utilization of convex optimization theory In particular, the cheating 
strategies determining the security level of such quantum protocols can be modelled by semidef- 
inite programming problems. In this paper, we deeply explore this cormection by examining an 
algebraic construct known as -point games. These point games are constructed from feasible dual 
solutions and, in this sense, are dual to the notion of protocols. We fully flesh out the details of 
these connections for a specific class of protocols and discuss how these connections extend to the 
classical version as well. We then discuss the philosophical ideas behind these connections and 
show some theoretical implications. 

Being able to interpret dual solutions to optimization problems has been very fruitful, even 
in the very special case of linear programming problems. Such interpretations typically lead to a 
deeper understanding of the behaviour of optimal solutions and better formulations of optimiza¬ 
tion problems modelling related phenomena. 

1.1 Quantum coin-flipping 

Corn-flipping is a classic cryptographic task introduced by Blum IBluSlI . In this task, two remotely 
situated parties, Alice and Bob, would like to agree on a uniformly random bit by communicating 
with each other. The complication is that neither party trusts the other. If Alice were to toss a coin 
and send the outcome to Bob, Bob would have no means to verify whether this was a uniformly 
random outcome. In particular, if Alice wishes to cheat, she could send the outcome of her choice 
without any possibility of being caught cheating. We are interested in a communication protocol 
that is designed to protect an honest party from being cheated. 

More precisely, a "strong coin-flipping protocol" with bias e is a two-party communication 
protocol in the style of Yao IIYao79irYao93l . In the protocol, the two players, Alice and Bob, start 
with no inputs and compute a value ca, cb G {0,1}, respectively, or declare that the other player is 
cheating. If both players are honest, i.e., follow the protocol, then they agree on the outcome of the 
protocol (cA = Cb), and the coin toss is fair (Pr(cA = cb = b) = 1/2, for any b G {0,1}). Moreover, 
if one of the players deviates arbitrarily from the protocol in his or her local computation, i.e., 
is "dishonest" (and the other party is honest), then the probability of either outcome 0 or 1 is at 
most 1/2 -I- e. Other variants of corn-flipping have also been studied in the literature. However, in 
the rest of the article, by "coin-flipping" (without any modifiers) we mean strong coin flipping. 

A straightforward game-theoretic argument proves that if the two parties in a coin-flipping 
protocol communicate classically and are computationally unbounded, at least one party can cheat 
perfectly (with bias 1/2). In other words, there is at least one party, say Bob, and at least one out¬ 
come b G {0,1} such that Bob can ensure outcome b with probability 1 by choosing his messages 
in the protocol appropriately. Consequently, classical coin-flipping protocols with bias e < 1/2 
are only possible under complexity-theoretic assumptions, and when Alice and Bob have limited 
computational resources. 

The use of quantum communication offers the possibility of "unconditionally secure" cryp¬ 
tography, wherein the security of a protocol rests solely on the validity of quantum mechanics 
as a faithful description of nature. The first few proposals for quantum information processing, 
namely the Wiesner quantum money scheme IIWie83l and the Bermett-Brassard quantum key ex¬ 
pansion protocol iBB84| were motivated by precisely this idea. These schemes were eventually 
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shown to be unconditionally secure in principle [MayOl ILC991 [PSOOl 1MVW121 . In light of these 
results, several researchers have studied the possibility of quantum coin-flipping protocols, as a 
step towards studying more general secure multi-party computations. 

Lo and Chau IILC97I and Mayers [ May97| were the first to consider quantum protocols for coin¬ 
flipping without any computational assumptions. They proved that no protocol with a finite num¬ 
ber of rounds could achieve 0 bias. Nonetheless, Aharonov, Ta-Shma, Vazirani, and Yao BATVYOOI 
designed a simple, three-round quantum protocol that achieved bias 0.4143 <1/2. This is im¬ 
possible classically, even with an unbounded number of rounds. Ambainis lAmbOlll designed a 
protocol with bias 1/A a la Aharonov et ah, and proved that it is optimal within a class (see also 
Refs. iSR01i!KN04| for a simpler version of the protocol and a complete proof of security). Shortly 
thereafter, Kitaev IIKit02t proved that any strong coin-flipping protocol with a finite number of 
rounds of communication has bias at least {\/2 — l)/2 « 0.207 (see Ref. IIGW07II for an alternative 
proof). Kitaev's seminal work uses semidefinite optimization in a central way. This argument 
extends to protocols with an unbounded number of rounds. This remained the state of the art for 
several years, with inconclusive evidence in either direction as to whether 1/4 = 0.25 or (\/2 —1)/2 
is optimal. In 2009, Chailloux and Kerenidis IICK09II settled this question through an elegant pro¬ 
tocol scheme that has bias at most {y/2 — l)/2 -I- <5 for any 5 > 0 of our choice (building on IIMoc07l , 
see below). We refer to this as the CK protocol. 

The CK protocol uses breakthrough work by Mochon IIMoc07l , which itself builds upon the 
"point game" framework proposed by Kitaev. Mochon shows there are weak coin-flipping proto¬ 
cols with arbitrarily small bias. This work has since been simplified by experts on the topic; see 
e.g. I ACG^lil .) A weak coin-flipping protocol is a variant of coin-flipping in which each party 
favours a distinct outcome, say Alice favours 0 and Bob favours 1. The requirement when they 
are honest is the same as before. We say it has bias e if the following condition holds. When Alice 
is dishonest and Bob honest, we only require that Bob's outcome is 0 (Alice's favoured outcome) 
with probability at most 1/2 -|- e. A similar condition to protect Alice holds, when she is honest 
and Bob is dishonest. The weaker requirement of security against a dishonest player allows us to 
circumvent the Kitaev lower bound. While Mochon's work pins down the optimal bias for weak 
corn-flipping, it does this in a non-constructive fashion: we only know of the existence of protocols 
with arbitrarily small bias, not of its explicit description. Moreover, the number of rounds tends to 
infinity as the bias decreases to 0. As a consequence, the GK protocol for strong coin-flipping is 
also existential, and the number of rounds tends to infinity as the bias decreases to {y/2 — l)/2. It 
is perhaps very surprising that no progress on finding better explicit protocols has been made in 
over a decade. 


1.2 Our results 

To state our results, we introduce the following four quantities: 

PgThe maximum probability with which a dishonest Bob can force an honest Alice to out¬ 
put c G {0,1} by digressing from protocol. 

The maximum probability with which a dishonest Alice can force an honest Bob to out¬ 
put c G {0,1} by digressing from protocol. 

We define a family of quantum coin-flipping protocols based on bit-commitment which we call 
BCCF-protocols. These protocols are parameterized by four probability distributions ao, ai de¬ 
fined on a finite set A and do, di defined on a finite set B. We formulate the cheating strategies for 


4 































Alice and Bob forcing an outcome of 0 or 1 as semidefinite programs in the style of Kitaev HKit02I . 
It can then be shown that the optimal cheating probabilities of a cheating Alice and a cheating Bob 
can be written as the maximization of a linear combination of fidelity functions over respective 
polytopes Va and Vb (this was also proved in our previous work IINST14I using direct arguments). 
For example, 

PX,0 = niax|^ Y Pa,yF{s^^’y\aa) : {si, . . . , Sn, s) e Va 

[ ae{0,i}yeB 

where is the projection of s onto the fixed indices a and y, and 



Pb,i = max ^ - 


Y F ((“a ® /3a) : (Pl, • • • ,Pn) G 

ae{ 0 ,i} 


(See Theorems 3.4 and 3.7 for formal statements of Bob's and Alice's cheating probabilities, re¬ 
spectively.) We discuss how these optimization problems can be written as semidefinite programs 
(which are much simpler than the original formulations) and, furthermore, it was noted in IINST14I 
that one can use second-order cone programming to model such optimization problems. We remark 
why this is interesting below. 

Using the above semidefinite programs, we develop the point games IIMoc07[ lACG+141 cor¬ 
responding to a BCCF-protocol, which we call BCCF-point games. We then prove cormections 
between the cheating probabilities in BCCF-protocols and the final point [Cb,i, Ca,o] of a BCCF- 
point game. More precisely, we prove that the final point [Cb,i, Ca,o] of any BCCF-point game 
satisfies q < Ca,o and P^i < Cb,i in the corresponding BCCF-protocol and there exist point 

games with final point Pb i’ ^^A o • bound all four cheating probabilities in a BCCF-protocol, 
we consider the point games in pairs, one of which bounds Pf q and Pg ^ and the other bounds 
Pf I and Pg 0 - More precisely, we have the following theorem. 


Theorem 1.1 ((Informal) See Theorem |4.8| f or a formal statement) Suppose [Cb,i, Ca,o] is the final 
point of a BCCF-point game and [Cb, 0 ) Ca,i] is the final point of its pair. Then 

Pb,o — Cb, 0 ) Pb,i — Cb, 1 ) Pa,o — Ca, 0 ) and Pf^ — Ca,i- 


Moreover, there exists a pair of BCCF-point games with final points 


P* P* 

-^A,0 


and 


P* p* 


This is a restatement of weak duality/strong duality of semidefinite programming in the con¬ 
text of protocols and point games. We discuss these connections in Section]^ 

Our analysis of the quantum protocols shows similarities to a related family of classical coin- 
flipping protocols based on bit-commitment, which we call classical BCCF-protocols. We can 
write the maximum cheating probabilities of these classical protocols in a very similar way, but 
using linear programming instead of semidefinite programming or second-order cone program¬ 
ming. For example, we can write 


P^ Q = max 


^EE E 

aSAp yeB a:esupp(Q!a) 


f^a,ySa,x,y 


: (si,..., Sn, s) G Va 
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and 


Pb 1 = max < ^ X] P^’^>y ■ (Pi^ - ■ ■ ^Pn) 

asAJ, j/esupp(/3a) a:eA 

Using the similarities to the quantum case, we develop their point games as well which we call 
classical BCCF-pornt games. Considering them in pairs, we have the classical version of Theo¬ 
rem [hi} below. 



Theorem 1.2 ((Informal) See Theorem |5.4| f or a formal statement) Suppose [Cb,i, Ca,o] the final 
point of a classical BCCF-point game and [Cb.O; Ca,i] Is the final point of its pair. Then 

Plo < Cb,o, ^b,i < Cb,i, Pa,o < Ca,o, and Pf^, < Ca,i, 


where P^ q, P^ Pf q, Pf ^ are the maximum cheating probabilities for the classical BCCF-protocol. More¬ 


over, there exists a pair of classical BCCF-point games with final points 


P* p* 

'^A,0 


and 


p* p* 

-'^8,0J -'^A,! 


The relationships between the quantum and classical versions of the BCCF-protocols and 
BCCF-point games are illustrated in Figure [^below. 

Duality 

Primal <-> Dual 


(Quantum) SDP/SOCP 

A 


_ Duality^_ 

Cheating (Bob’s SDP) -^^^ ^Bob’s Dual SDP) Solutions 



(Quantum Protocop 


Polytope 


Setting 

Measurement 


Restricted F.R. 


(Bob’s LP) - (Bob’s Dual LP) 


A 

(Classical) LP 


(Classical Protocop 


Point Splitting 


(Classical Point Game ) 


( Alice’s LP) - (Alice’s Dual LP) 


Figure 1: Crystal structure of BCCF-protocols. F.R. denotes "feasible region", SDP abbreviates 
"semidefinite programming", SOCP abbreviates "second-order cone programming", and LP ab¬ 
breviates "linear programming". 

This figure gives a nice philosophical view of how the generalization of quantum mechanics 
from classical mechanics is analogous to the generalization of semidefinite programming from 
linear programming. As mentioned previously, it was shown in IINST14II that the optimal cheating 
strategies in the quantum version can be formulated using second-order cone programming which is 
a special case of semidefinite programming but still a generalization of linear programming (see 
Subsection |2.2| . This suggests that BCCF-protocols are very simple compared to general quantum 
protocols, which is indeed the case. However, they are still provably more general than classical 
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protocols. To put another way, just as the simple structure that makes our family of quantum 
protocols fit nicely between the set of classical and quantum protocols, the class of optimization 
problems that can be modelled as second-order cone programs fits nicely between those that can 
be modelled as linear programs and those that can be modelled as semidefinite programs. We 
discuss further this analogy and how to view a spectrum of optimization problems between linear 
programming and semidefinite programming (and beyond) in Section 

Independent of our work and observations above, a similar phenomenon was exposed by 
Fiorini, Massar, Pokutta, Tiwary, and de Wolf ||FMP~*~12|| in research involving extended linear 
programming vs. extended semidefinite programming formulations in combinatorial optimiza¬ 
tion. 

Moreover, we can use these relationships to prove theoretical results. In particular, by examin¬ 
ing the classical BCCF-point games, we can prove that at least one party can cheat with probability 
1. A closer look reveals that there is no classical BCCF-protocol where both parties can cheat with 
probability 1 (which extends to the quantum case as well). This is summarized in the following 
theorem. 


Theorem 1.3 ((Informal) See Theorem |5.6| f or a formal statement) Alice and Bob cannot both cheat 
perfectly in a quantum BCCF-protocol. Exactly one of Alice or Bob can cheat perfectly in a classical BCCF- 
protocol. 

We then address the problem of finding the smallest bias for quantum BCCF-protocols. We 
do this by examining what happens when both of Kitaev's lower bounds Tao^b o — 

PfiP^i P 1/2 are saturated. 

Theorem 1.4 ((Informal) See Theorem |6.1| f or a formal statement) If a quantum BCCF-protocol sat¬ 
urates both of Kitaev's lower bounds, then the cheating probabilities are the same as in the corresponding 
classical protocol. 

We can combine the above two results to use classical protocols to lower bound the quantum bias. 
Corollary 1.5 In every quantum BCCF-protocol, we have maxlP^ o> -^A n O’ -^b i } > l/\/2. 


1.3 Organization of the paper 

We start with establishing notation and terminology on linear algebra, optimization problems 
of interest and some technical lemmas in Section Background on coin-flipping and Kitaev's 
protocol and point game formalisms can be found in Appendix]^ In Section]^ we introduce the 
family of quantum protocols we consider in this paper and formulate their cheating strategies 
using semidefinite programming. The corresponding point games are developed and analyzed in 
Section]^ A family of related classical protocols and their point games are examined in Section]^ 
and used to lower bound the quantum bias in Section]^ We end with conclusions in Section]^ 


2 Background 

In this section, we establish the notation and the necessary background for this paper. 
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2.1 Linear algebra 


For a finite set A, we denote by Prob"^, and the set of real vectors, nonnegative real 

vectors, probability vectors, and complex vectors, respectively, each indexed by A. We use M", 
M”, Prob”, and for the special case when A = {1,..., n}. We denote by and the set of 
Hermitian matrices and positive semidefmite Hermitian matrices, respectively, each over the reals 
with columns and rows indexed by A. 

It is convenient to define ^/x to be the element-wise square root of a normegative vector x. The 
element-wise square root of a probability vector yields a unit vector (in the Euclidean norm). This 
operation, in some sense, is a conversion of a probability vector to a quantum state. For a vector 
p G we denote by Diag(p) G the diagonal matrix with p on the diagonal. For a matrix 

X G we denote by diag(X) G the vector on the diagonal of X. For a vector x G C^, we 

denote by supp(x) the set of indices of A where x is nonzero. We denote by x~^ the vector of 
inverses, i.e., each entry in the support of x is inverted, and 0 entries are mapped to 0. 

For vectors x and y, the notation x > y denotes that x — y has normegative entries, x > y 
denotes that x — y has positive entries, and for Hermitian matrices X and Y, the notation X '^Y 
denotes that X — Y is positive semidefmite, and X >- Y denotes X — y is positive definite when 
the underlying spaces are clear from context. 


The Schur complement of the block matrix X 


A B 
C D 


is S := A — BD ^C. Note that 


when H ^ 0 and C = B* with A Hermitian, then X y 0 if and only if 5 ^ 0. 

The Kronecker product of two matrices X and Y, denoted X (8> H, is defined such that the 
i,j'th block is equal to Xij ■ Y. Note that X ®Y ^ when X G and Y e and 

Tr(X (g) y) = Tr(X) • Tr(y) when X and Y are square. 

The Schatten 1-norm, or trace norm, of a matrix X is defined as 


||X||i := Yv{VX*X), 

where X* is the adjoint of X and Vx denotes the Hermitian square root of a Hermitian positive 
semidefmite matrix X, i.e., the Hermitian positive semidefmite matrix Y such that Y^ = X. Note 
that the 1-norm of a matrix is the sum of its singular values. The 1-norm of a vector p G is 
defined as 

ii^^iii •= \px\- 

x^A 

For a matrix X, we denote by Null(X) the nullspace of X. We denote by (X, y) the standard 
irmer product of matrices acting on the same space given by Tr(X*y). 

We use the notation a to denote the complement of a bit a with respect to 0 and 1 and a © 6 to 
denote the XOR of the bits a and b. We use Z 2 to denote the set of n-bit binary strings. 

A convex set C is a convex cone if Ax G C when A > 0 and x G C. The dual of the convex cone 
C, denoted C*, is the set {y : (x, y) > 0, Vx G C}. 

A function / : S” —^ S™ is said to be operator monotone if 


/(X) © /(y) when X © y. 


The set of operator monotone functions is a convex cone. 

A polyhedron is the solution set of a system of finitely many linear inequalities (or equalities). 
A polytope is a bounded polyhedron. 
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The (quantum) partial trace over Ai, denoted Tr^j, is defined as the unique linear transformation 
which satisfies 

TrAi(/9i (8) P2) = Tr(/9i) • p2 

for all pi G and p 2 G More explicitly, given any matrix X G -^^0 have 

TrAi(X);= ^ (e*^(8)lA2)^(ea;i®lA2), 

xiGAi 

where {cx^ : xi G ^ 1 } is the standard basis for In fact, the definition is independent of the 
choice of basis, so long as it is orthonormal. The adjoint of the partial trace is the transformation 
Tt\{X) = X®\a. 

We also define the classical partial trace over Ai, denoted Tr^i : ^ as the linear 

transformation 

TrAi(p) = (8)I)p, 

where e^i is the vector of all ones indexed by xi G Ai. If p is a probability vector over Ai x A 2 , 
then Tr^i (p) is the marginal probability vector of p over A 2 . The adjoint of the classical partial 
trace is the transformation Tr^(p) = p® ca- 

We define the fidelity of two normegative vectors p,q G as 

F{p,q) := I ^ VixVof 

\x£A 

and the fidelity of two positive semidefmite matrices pi and p 2 as 

F(pi,P2) := 

Notice, F(pi, P2) > 0 with equality if and only if (pi, P2) = 0 and, if pi and p2 are quantum states, 
F(pi, P2) < 1 with equality if and only if pi = p2. An analogous statement can be made for the 
fidelity over probability vectors. 

Another distance measure is the trace distance. We define the trace distance between two prob¬ 
ability vectors p and q, denoted A(p, q), as 

A(p,g) := ^ Up- gill- 

This is also commonly known as the total variation distance. We similarly define the trace distance 
between two quantum states pi and p 2 as 

A(pi,P 2) := ^ ||pi -P2|li- 

Notice A(pi, P2) > 0 with equality if and only if pi = p2 and A(pi, P2) < 1 with equality if and only 
if (pi, P 2 ) = 0. The analogous statement can be made for the trace distance between probability 
vectors. 

We use the notation eig(A) to denote the set of (distinct) eigenvalues of a matrix X and to 
denote the projection onto the eigenspace of X corresponding to the eigenvalue A G eig(A). 
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2.2 Optimization classes 
2.2.1 Semidefinite programming 

A natural class of optimization problems when studying quantum information is semidefinite 
programming. A semidefinite program, abbreviated as SDP, is an optimization problem with 
finitely many Hermitian matrix variables, a linear objective function of these variables, and finitely 
many constraints enforcing positive semidefiniteness of some linear functions of these variables. 
Every SDP can be put into the following standard form using some elementary reformulation 
tricks: 

(P) sup (C',A) 

subject to A{X) = 6, 

A G S", 

where A : S” —)• is linear, C G and b G M™. The SDPs that arise in quantum computation 

involve optimization over complex matrices. However, they may be transformed to the above 
standard form in a straightforward manner, by observing that Hermitian matrices form a real 
subspace of the vector space of n x re complex matrices. We remark here that the data defining 
the optimization problems in this paper are always real and thus we can restrict ourselves to real 
matrix variables without loss of generality. 

We can write the dual of (P) as 

(D) inf {b, y) 

subject to A*{y) — S = C, 

S G S!;, 

where A* is the adjoint of A. We refer to (P) as the primal problem and to (D) as its dual. It is 
straightforward to verify that the dual of (D) is (P). 

We say X is feasible for (P) if it satisfies the constraints A{X) = b and X G S”, and {y, S) is 
feasible for (D) if A* (y) — S = C, and S' G S+. The usefulness of defining the dual in the above 
manner is apparent in the following lemmas. 

Lemma 2.1 (Weak duality) For every X feasible for (P) and {y, S) feasible for (D) we have 

{C,X)<{b,y). 

Using weak duality, we can prove bounds on the optimal objective value of (P) and (D), i.e., 
the objective function value of any primal feasible solution yields a lower bound on (D) and the 
objective function value of any dual feasible solution yields an upper bound on (P). 

Under mild conditions, we have that the optimal objective values of (P) and (D) coincide. 

Lemma 2.2 (Strong duality) If the objective function o/(P) is bounded from above on the set of feasible 
solutions o/(P) and there exists a strictly feasible solution, i.e., there exists X y 0 such that A{X) = b, 
then (D) has an optimal solution and the optimal objective values o/(P) and (D) coincide. 

A strictly feasible solution as in the above lemma is also called a Slater point. Semidefinite pro¬ 
gramming has a powerful and rich duality theory and the interested reader is referred to HWSVOOI . 
ITW12I . and the references therein. 
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2.2.2 Second-order cone programming 

The second-order cone (or Lorentz cone) in M", n > 2, is defined as 

soc*^ := {{x,t) G ©M : t > ||a:|| 2 } . 

A second-order cone program, denoted SOCP, is an optimization problem of the form 

(P) sup (c, x) 

subject to Ax = b, 

X G SOC"i © • • • © SOC^^ 

where A is an m x (X]^=i matrix, b G M™, c G and k is finite. We say that a feasible 

solution X is strictly feasible if x is in the interior of SOC^^ © • • • © SOC”''. 

An SOCP also has a dual which can be written as 

(D) inf (6, y) 

subject to A~^y — s = c, 

s G SOC^i © • • • © SOC"© 


Note that weak duality and strong duality also hold for SOCPs for the above definition of a strictly 
feasible solution. 

A related cone, called the rotated second-order cone, is defined as 

RSOC" := {(a,6,x) G M©M©M”“2 :a,b>0, 2ab > HxHg} . 


Optimizing over the rotated second-order cone is also called second-order cone programming 
because {x,t) £ SOC"^ if and only if {t/2,t,x) G RSOC"^^^ and {a,b,x) G RSOC"^ if and only if 
(x, a, 6, a + 6) G and a,b > 0. In fact, both second-order cone constraints can be cast as 

positive semidefinite constraints: 


t > ||x||2 


T 


t X 
X tl 


©0 and a,b > 0, 2ab > \\x 


2a x~^ 
X 61 


© 0 . 


Despite second-order cone programming being a special case of semidefinite programming, 
there are some notable differences. One is that the algorithms for solving second-order cone pro¬ 
grams can be more efficient and robust than those for solving semidefinite programs. We refer the 
interested reader to IIStu99lIStu02[IMit03[IAG03II and the references therein. 


2.2.3 Linear programming 

A linear program, denoted LP, is an optimization problem of the form 


(P) max (c, x) 

subject to Ax = b, 

x G M!;:, 


where A is an m x n matrix, c G M” and 6 G M™'. 


11 








Linear programming is a special case of both second-order cone programming and semidef- 
inite programming. This can be seen by casting a nonnegativity constraint f > 0 as the SOC 
constraint (0, t) G SOC^. Associated with every linear program is its dual which is defined as 

(D) min (6, y) 

subject to A^y — s = c, 
s G M" . 

Note that in this special case, we do not require strict feasibility to guarantee strong duality. If a 
linear program is feasible and its objective function is bounded over its feasible region, then it and 
its dual attain an optimal solution and the optimal values always coincide. 

2.3 Technical lemmas 

In this subsection, we present a few lemmas which are helpful in the analysis in this paper. 
Lemma 2.3 ( IINST14I ) For every p,q € M+, we have 

F{p, q) = max{(A, y/py/p^) : diag(X) = q, X e S+}. 

Note that 

F{p,q)= inf {{y,q) : Diag(?/) ^ y/p^'^} = mf {{y,q) : {y~^,p) < l} = inf {{y, q) {y~^, p)} 

y>o y>o 

by using the observation 

F)iag{y) h VpVp^ ^ Diag(y)“^/^VP\/p"^Diag(y)“^/^ 1 > ^ . 


We use this characterization of the inequality Diag(y) ^ y/Py/p^ several times throughout this 
paper. 

Notice that F(p,g) = infj^>o {(y, g) ( 2 /“^, p)} is the classical version of Alberti's Theorem HAlb83l , 
which states that F(p, a) = inf^^o (A, p) {X~^, a) for quantum states p and a. 

We can apply the same trick above to the inequality Diag(y) 0 Ia ^ when y > 0 to get 

the equivalent condition 1 > ('(/;|Diag(y)“^(8)lA|V’)/which works for any |'i/)) G In particular, 

we have the following lemma. 

Lemma 2.4 For every p G M+ and {ip) := YIx&a \xx), we have 

{y > 0 : Diag(y) ^ y/p^/p'^} = {y > 0 : Diag(y) 01a ^ IV’)(V'|}- 
We also make use of the lemma below. 

Lemma 2.5 ( HNST14I ) For every /3o, /3i £ Prob'®, we have 

V max {13a,y} = 1 -t A(/3o, /3i). 
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3 A family of quantum coin-flipping protocols 

In this section we introduce the coin-flipping protocols examined in this paper. Intuitively, Alice 
"commits" to a bit a (in superposition) by creating a state \'ipa) and revealing its subsystems one 
at a time. Bob does the same, he "commits" to a bit b by creating a state \4>b) and revealing its 
subsystems one at a time. Afterwards, they reveal their bits to each other and the outcome of the 
protocol is o © 6, if they both pass cheat detection. 

We now formally define the class of protocols considered in this paper. 

Protocol 3.1 (BCCF-protocol IINST14I ) A coin-flipping protocol based on bit-commitment, denoted 
here as a BCCF-protocol, is specified by four finite sets 

Ao:={0,1}, A-.= Aix A 2 X ■■■ X An, 5o:={0,l}, B := Bi x B 2 x ■ ■ ■ x Bn, 


two probability distributions ao, ai over A, and two probability distributions /3o, /3i over B. From these 
parameters, we define the quantum states: 


^ |aa)|V'a) e _ '^^/oFFfc\xx) G C 


AxA' 


^ ^ \hb)\(l)b) G ^ ^/W^y\yy) G C 


BxB' 


be{0,l} 


yeB 


and A'q := Aq, A' := A, B'q := Bq, and B’ := B are copies. 

The preparation, communication, and cheat detection of the protocol proceed as follows: 

• Alice prepares the state \ip) and Bob prepares the state If). 

• For ifrom 1 to n: Alice sends to Bob who replies with C^\ 

• Alice fully reveals her bit by sending She also sends C^' which Bob uses later to check if she was 
honest. Bob then reveals his bit by sending C^o. He also sends which Alice uses later to check if 
he was honest. 

• Alice performs the measurement (nA,o, Ha,!, Ha, abort) on the space §^o>^b^xBxb ^ 

nA,o:= \b){b\®\b){b\®\fb){fb\, nA,i:= \b)(b\®\b){b\0\fb){fb\, 

6e{o,i} 6e{o,i} 

and IIa, abort •— I HAjO Ba,!. 

• Bob performs the measurement (nB,o! IIb,!, Hb, abort) on the space ^ where 

Hb.o := ^ |a)(a| © |a)(a| © |V’a)(V'a|, Bb,! := ^ |a)(a| © |o)(a| © |V'a)(V’a|, 

ae{0,l} ae{0,l} 

and IIb, abort := I — nB,o — Hb,!. (These last two steps can be interchanged.) 
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Alice prepares l"^) G (^Agy^A'^xAixA^^A'-^^xA’^ 


Bob prepares |0) G (^Bqxb'qxBxxB 2 xb[xb'^ 


Alice sends (xi G A{) 


Bob sends (yi G -Bi) 


Alice sends (x 2 G A 2 ) 


Bob sends ( 2/2 G B 2 ) 


Alice sends (a G {0,1} and a copy of si, 2 : 2 ) 


Bob sends (fe g {0,1} and a copy of j/i, j/ 2 ) 


> 


> 




Alice checks if Bob cheated 


Bob checks if Alice cheated 


Alice and Bob output a © 6 if no cheating is detected 

Figure 2: A six-round BCCF-protocol. Alice's actions are in red and Bob's actions are in blue. 


A six-round BCCF-protocol is depicted in Figure Note that the measurements check two 
things. First, it checks whether the outcome, a© 6 , is 0 or 1 . The first two terms determine this, i.e., 
whether a = 6 or if a 7 ^ 6 . Second, it checks whether the other party was honest. For example, if 
Alice's measurement projects onto a space where b = 0 and Bob's messages are not equal to \4>o), 
then Alice has detected that Bob has cheated and aborts. 

As is shown in Figure we shall reserve the notation for indices: a G Aq, b G Bq, x £ A, 
Xi G Ai, y ^ B, and yi ^ Bi. We sometimes omit the sets when it is clear from context. 


3.1 Formulating optimal quantum cheating strategies as semidefinite programs 

We can formulate strategies for cheating Bob and cheating Alice as semidefinite programs in the 
same manner as Kitaev, as discussed in Appendix]^ The extent to which Bob can cheat is captured 
by the following lemma. 


Lemma 3.2 ( I1NST14I ) Bob's optimal cheating probability for forcing honest Alice to accept the outcome 
c G {0,1} is given by the optimal objective value of the following semidefinite program: 


^B,c = sup (pF,nA,c) 




subject to Tr Bi{pi) 

= TrAi|V’)(V'l, 



Trs.ipj) 

= TrA^(/3j-i), 

Vj G {2, . . 

. ,n}, 


~ T'^A'xAq (Pn)) 



Pj 

,,Aox AnXBi x---xf?j X A,_i_i x ••■x A„x A' 
G s+ , 

Vj G {1,.. 

. ,n}, 

PF 

^ gAoxB^xBxB' 
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The actions of a cheating Bob and the variables in the SDP are depicted in Figure]^ 


Alice prepares \ip) G 

T^aM){M 

<- 

Pi 

Ti'AdPi) 


Bob does not follow protocol 
Bob maintains purifications of p\, p 2 , pf 


Alice sends C^i ( 3:1 e A-i) 
Bob sends {yi e Si) 

Alice sends {x^ G A^) 

Bob sends { 1/2 6 S 2 ) 


P2 


TrA;,xA;xA^(P2) 


Alice sends (a g {0,1} and a copy of xi, 3 : 2 ) 


Bob sends (b g {0,1} and a copy of |/i, 1 / 2 ) 




Pf 


Alice checks if Bob cheated 


Bob simply outputs his desired outcome 


Figure 3: Bob cheating in a six-round BCCF-protocol. 

We now present a theorem showing that the cheating SDPs can have a certain, restricted form 
while retaining the same optimal objective value. At high level, we cut down the algebraic repre¬ 
sentation of the feasible region. Surprisingly, we are able to reformulate the feasible region by a 
polytope defined below. 

Definition 3.3 We define Bob's cheating polytope, denoted Vb, as the set of vectors {pi,p 2 ,... ,Pn) 
satisfying 

Trsi(pi) = CAi, 

Trsafe) = Pi 06^2, 


TrB„(pn) = Pn-i(8)eA„, 

Ai xSi X-.-X A,-XB, r 11 ■ r-t l 

Pj G M+ \ for all J £ {1,. 

where ca^ denotes the vector of all ones in the corresponding space 

We now use Bob's cheating polytope to capture his optimal cheating probabilities. 


Theorem 3.4 (Bob's reduced problems HNST14I ) For the BCCF-protocol defined by the parameters 
ao) ai £ Frob"^ and (3o,j3i £ Frob^, we have 


^B,o = max<^^ ^ : (pi,...,Pn) G'Pb 

aG{0,l} 


15 










and 


P^ i = max < - 


{ \ ^ ■ {Pl,---,Pn) 

ae{0,i} 


G Vb 


We refer to these as Bob's reduced 'problems. Note that we sometimes refer to them as Bob's reduced 


SDPs, implying we have replaced the fidelity with its SDP characterization from Lemma 2.3 


The above theorem can also be proved using the fact that the set {A xx* : A > 0} is an extreme 
ray of the cone of positive semidefmite matrices. That is, A xx* G for every A > 0 and, if 
Ali, ^2 G satisfy Xi + X 2 = X xx* for some A > 0, then Xi = Ai xx* and X 2 = X 2 xx* for some 
Ai, A 2 > 0 satisfying Ai + A 2 = A. This proof relies on a reduction of the primal problem alone 
and can be found in I1NST14I . In Appendix]^ we give an alternative proof via duality theory 
since some of the structure of optimal dual solutions are required for the construction of the point 
games in Section]^ In that appendix we also give context to the variables in the cheating polytope 
by deriving the corresponding cheating strategy. 

In a similar fashion, we formulate cheating strategies for Alice in the lemma below. 


Lemma 3.5 ( HNST14I ) Alice's optimal cheating probability for forcing honest Bob to accept the outcome 
c G {0,1} is given by the optimal objective value of the following semidefinite program: 


P 


= sup 


subject to 


Tr 


TrAi(o-i) 

ap 


Vj G {2,... ,n}, 


G 

G 


TrB^_i(o-j-i), 

TrB„(o-n), 

„BoxBLxAix---xAjXBiX--xB„xB' vj ■ ^ n i 

S+ ° , Vj G nj, 

^BoxB'fjXA'gxAxA'xB' 


Similar to cheating Bob, we can reduce the feasible region to a polytope, defined below. 

Definition 3.6 We define Alice's cheating polytope, denoted Vp^, as the set of vectors {si,S 2 , ■ ■ ■ ,Sn,s) 
satisfying 


TrAi(si) 

= 

1, 

TrA2('S2) 

= 

Si (8) CBi , 


= 

Sn-1 <8) CB, 

Tryij,(s) 

= 

Sn <8 CBr,, 

Si 

G 



G 

X X ■■■ 


AxBxA'q 


\ for all j £ {2 ,...,n}, 


where cbj is the vector of all ones in the corresponding space 

We can use this polytope to capture Alice's optimal cheating probabilities. 
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Theorem 3.7 (Alice's reduced problems IINST14I ) For the BCCF-protocol defined by the parameters 
ao, ai G Prob"^ and /3o, /3i G Prob^, we have 


PI q = max < X X] Z] 




a, 


i) : ('Si, • • • j Sn, s) G "Pa 


ae{0,i}yeB 


and 


PX,i = max<|- ^ ^/3s,y F(s^“’^\aa) : (si,..., s) G Pa )■ , 

[ ae{0,l}y(SB 

where 8^°’’^^ is the projection of s onto the fixed indices a and y. 


We refer to these as Alice's reduced problems or Alice's reduced SDPs when using the SDP char¬ 
acterization of the fidelity function from Lemma |2.3[ Context of the variables in Alice's cheating 
polytope and a proof of the above theorem are in Appendix [P] 


Remark We can see from Theorems 3.4 and |3.7| that switching (3q and /3i switches the values of 
Pg Q and Pg ^ and it also switches the values of Pf q and Pf ^. We make use of this symmetry 
several times in this paper. 


As an example, and for future reference, we write the dual of Bob's reduced cheating SDP for 
forcing outcome 1 and the dual for Alice's reduced cheating SDP for forcing outcome 0, respec¬ 
tively, below 


inf TrAi(w^i) 



inf zi 



s.t. 7Ci(8)es^ 

> 

Tva2{w2), 

s.t. Zl ■ CAi 

> 

Ti'Bi(22), 

W2 (8) €32 

> 

TvAsiws), 


> 


Wn <8 eB„ 

> 

5 X]ae{0,l} ““ ® W, 

Zn ® eA„ 

> 

"FrB„(2n+l)) 

Diag(ua) 


, Va, 

Diagizlfl^) 


®a\/ ) '^CL,y. 


The structure of the reduced problems was an observation after numerically solving some 
cheating SDP examples. We note that there are some similarities between the reduced prob¬ 
lems above and the optimal solutions of the cheating SDPs for the weak coin-flipping protocols 
in UMocOSl . The protocols Mochon considers in IMocOSI also give rise to "reduced problems" be¬ 
ing the maximization of fidelity functions over a polytope. However, the analysis is much cleaner 
in Mochon's work since the objective function only involves a single fidelity function as opposed 
to the linear combination of fidelity functions that arise for BCCF-protocols. This difference is due 
to the fact that weak coin-flipping protocols often allow a stronger cheat detection step than those 
for strong coin-flipping. Having a single fidelity function allowed Mochon to construct an optimal 
solution using a dynamic programming approach. The structure of the objective functions in the 
reduced problems above for BCCF-protocols has not so far revealed an obvious way to solve it 
using dynamic programming, making this family of protocols harder to analyze. 
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4 Point games for BCCF-protocols 


In this section, we develop the point games corresponding to BCCF-protocols. Although this 
section is self-contained, an interested reader may wish to see our Appendix for a review of 
point games or consult the work of IIMoc07[|ACG^141 . 

To summarize the idea behind point games, we take a feasible dual solution for Bob cheating 
towards 1 and the same for Alice cheating towards 0 and consider the behaviour of their eigen¬ 
values. When pairing certain eigenvalues from Bob with those from Alice, we obtain a collection 
of finitely-many weighted points in the two-dimensional nonnegative orthant. The points have 
a time-ordering to them and the transitions from one time step to the next are called "moves" 
or simply "transitions" and the rules for these transitions can be described independently from 
the protocol description. In this section, we examine the set of allowable moves for point games 
derived from BCCF-protocols in the manner described above, and use them to find a protocol 
independent definition. 

We start by examining Kitaev's lower bound involving the quantities Pg ^ and q. Since we 
are concerned with strong coin-flipping, the choice of Bob desiring outcome 1 and Alice desiring 
outcome 0 for this part is somewhat arbitrary. However, this way we can compare them to point 
games for other classes of weak coin-flipping protocols (see IIMoc07ll ). We later show that we 
lose no generality in choosing these two values, as we consider all four values simultaneously by 
viewing the point games in pairs. 

The dual for Bob's cheating SDP for forcing outcome 1 is given by 


P^ 1 = inf 
subject to 


(Wi,TrAjV’)(V'l) 

Wj ® Ibj 

P 

Wj+i ® lAj+i, for all j G {1, ..., n 

Wn ® Ib„ 

P 

Wn+l ® Ia' ® IaP 

Wn+l ® Ib' ® Is' 

P 

Haa, 

Wj 

G 

gAox AqXBi X •••xBj_i X Aj+i x •••x A„x A' 

Wn+l 

G 

for all j G {l,...,n}, 

gAoxB^ 


and the dual for Alice's cheating SDP for forcing outcome 0 is given by 


Plfi = I </>)(</>!) 

subject to Zj (g) Ia^ 

Zn+l ® Ia' ® Ia' 


P Zj+i ® Ib^ , for all j G {1,..., n} , 

P T1b,o ® ® I_B', 

^ gBoxBpX Ai X ••■X Aj_i xBj x---xB„xB' 

for all j G {1,..., n, n -|- 1}. 


From SDP strong duality, we know that for every <5 > 0, we can choose (kPi,..., Wn+i) feasible 
for the dual of Bob's cheating SDP and (Zi,..., Zn+i) feasible for the dual of Alice's cheating SDP 
such that 

(p^,i+ 5) (PXo +5)> (Wi ® zi,TTA,m{i’\ ® \^)m- 

For brevity, we define \^j) and |^') equal to \ip)\4>) (with the spaces permuted accordingly) to be 
the states of the protocol before Alice's j'th message and before Bob's j'th message, respectively, 
when they follow the protocol honestly. From the dual constraints, we have 

{W,®Z„Ti-a,\^j){C,\) > {Wj®Z,+uT^BMj)i0 > {Wj+^®Zj+,,Tr:A,^ACj+i){^j+i\) 
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for j G {1,..., n — 1}, and for the last few messages we have 


® ^n+1, dViJ JO (Cl > 

^ (lfJ+1 ® ■^n+1) Tr^QX^l'ICn+l) ('^n+11) 

> {Wn+l ® nB,0,Tr5^xB'lC+l)(C+ll) 

> (IIa,! <8) Hb.O, |^n+2)(C+2|) 


and the last quantity equals 0 since Alice and Bob never output different outcomes when they are 
both honest. Note that these are dual variables from the original cheating SDPs, not the reduced 
version. The dual variables for the reduced version are scaled eigenvalues of the corresponding 
dual variables above. However, we do reconstruct Kitaev's proof above using the reduced SDPs 
in Section]^ 

As was done in IIMoc07l , we use the function Prob : x x §0^ defined as 


Prob(A, y, a) 


E E 

Aeeig(V) /ieeig(y) 



where [A, p] : —)■ {0,1} denotes the function that takes value 1 on input (A, p) and 0 otherwise. 

Note this function has finite sup-port which are the points in the point game. The quantity 

is said to be the associated probability of the point [A, p]. 

To create a point game for a BCCF-protocol, we use the points that arise from feasible dual 
solutions in the following way: 


Po 

:= Prob(nA,l,nB,0, Cn+2)(^n+2 ), 



p'l 

: = Prob(iy,,+i, Hb.o, Tr^/ xs' 1 C+i) (Cn+i 1)> 



Pi 

:= Prob(lHi+i, Zn+l, TrAJjxA'l?n+l)(^n+ll)) 



P\n+2)-j 

:= Prob(iy„Z,+i,TrBj^')(?J), 

for all j G {1,.. 

. ,n}, 

P{n+2)-j 

:= PToh{Wj,Zj,TTAfCj)m, 

for all j G {1,.. 

. ,n}, 


noting that the Tth point corresponds to the f'th last message in the protocol. This gives rise to the 
point game moves (or transitions): 

PO Pi Pi Pj Pi Pn+l Pn+1, 

which we give context to in the next subsection. The reason we define point games in reverse 
time order is so that they always have the same starting state and it is shown later that the final 
point captures the two objective function values of the corresponding dual feasible solutions. The 
reverse time order ensures that we always start with the same po and aim to get a desirable last 
point, instead of the other way around. 

First, we calculate Prob(iyj, Zj,TrAj |'^j)(0l)' 7 £ {1; • • ■) n}. 

Definition 4.1 For a string z G {0,1}*, zve define p{z) as the probability of string z being revealed during 
an honest run of a fixed BCCF-protocol. 
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To capture these probabilities, we use the following (unnormalized) states defined from the 
honest states in a BCCF-protocol. 

Definition 4.2 For x = (xi,..., x„) € A, y = {yi,..., yn) G B, and j G {1,..., n}, define 

•= 'y ^ ■■■ y ^ y ^ \/Oia,x l®®) ^ Xn)\Xj-\-l, . . . , X-n) 

and ^ 

\^yi,-,yj) ■= ^ ^ ■■■ Z] X] V^y\^^)\y3+^^---^yn)\yj+u---,yn)- 

yn^Bn 6g{0,1} 


Note we have p{xi,...,Xj) = for all {xi,...,Xj) G Ai x ■■■ x Aj, and 

P{yi, = (</>2yi,...,yj^t/i,...,?;j)/for all {yi,... ,yj) e Bi x ■ ■ ■ x BjJorj G {1,... ,n}. 

From the proof of the reduced problems in Appendix]^ we can assume an optimal choice of 
Wj has eigenvalues / where wj is the corresponding variable in the dual of Bob's 

reduced cheating SDR Note that we do not need to worry about the case when p{xi,... ,Xj) = 0 
(nor the division by 0) since this implies Wj^xi,yi,...,yj-i,xj = 0. The same argument holds in the fol¬ 
lowing cases whenever there is an issue of dividing by 0. The positive eigenvalues have respective 
eigenspace projections 

^[^,yi,...,yj_l,x,] __ _ _ . ,yj_i,Xj){xi,yi,. . .,yj-i,Xj\ (g) \'4>xi,...,Xj){'4’xi,...,Xj\, 


where |V’a:i,...,a;j) is \'f’xi,...,xj) normalized. The other eigenvalues do not contribute to the points 
(this can be verified since these eigenvalues already contribute to probabilities adding to 1). Sim¬ 
ilarly, an optimal choice of Zj has eigenvalues / where zj is the corresponding 

variable in the dual of Alice's reduced cheating SDR, with respective eigenspaces 


Tt[^1 iVl V ■ - —1 — l] 


1^1! 2/1) • • • ) 1) //j—l) (^1) 2/1) • ■ ■ ) 1; 2/i—11 ® ) {fyi,...,yj-i I) 


where is normalized. From these eigenspaces, we can compute 






^Xl,x'^ 


' ^Xj-i,x'._j^^yi,y[ ■ ■ ■ R(^1) 2/1) • • • ) 2/i-l) Xj)- 


Thus, we can write the point •= BToh{Wj, Zj ,Ti Af^j) {ij\) 


as 


E E- E E p{xi,yi,...,yj-i,xj) 

aJiSAij/iSBi yj-^eBj-iXjeAj 




p{xi,...,Xj) ’ p{yi, . . . ,yj-i) 

We can similarly write p'(^^j^ 2 )-j Prob(FFj, Z)+l.TVB,|«')K'|)as 


E E-E E p(xi,2/i,...,xy2/i) 

a:iSAi j/iSSi Vj^Bj Xj£Aj 


p{xi,...,Xj) ’ p{yi,...,yj) 
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The first three points are different from above as they correspond to the last few messages in 
the protocol (which are quite different from the first 2n messages). Nonetheless, the process is the 
same and we can calculate them to be 


Pi = 


/ 

Pi 


E EE p{x,a)p{y) 

ae{0,l} xeAyeB 


Va,y 


Zn+l,x,y 

p{y) 


E E ^piy, b) I Vb,y, 01 + ^ ^piy, b) 


Po = A 


b&{0,l}yeB 

^ 1,0 


b,y 


^b,yi 1 


1 

+ 2 


0 , 1 


noting Zn+i,x,y > 0 whenp(?/) > 0. 

We call any point game constructed from dual feasible solutions in this manner a BCCF-point 
game. In the next subsection, we describe rules for moving from one point to the next in any 
BCCF-point game yielding a protocol independent definition. 


4.1 Describing BCCF-point games using basic moves 


Below are some basic point moves (or transitions) as Mochon describes them in [Moc07 


Definition 4.3 (Basic moves) 


Point raising: 
Point merging: 

Point splitting: 


q 

qi 


w, z 


W, Zl 


w, z 


, for z < z', 


+ 92 


(9i + 92) 


w, 


W, Z2 


9i + 92 


+ ( 2 ^ 
' Z2 


(91 + 92) 


91 


w. 


qiZi + q2Z2 
9i + 92 


W, Zl 


+ 92 


W, Z2 


, for zi,Z 2 f 0. 


An example of point splitting and point raising can be seen in Figure]^ and examples of point 
mergings can be seen in Figures]^ andUsing a slight abuse of the definition of point splitting, if 
we perform a point split then raise the points, we still refer to this as a point split (for reasons that 
will be clear later). Also, we can merge or split on more than two points by repeating the process 
two points at a time. 

These are moves in the second coordinate (keeping the first coordinate fixed) called vertical 
moves, and we similarly define horizontal moves acting on the first coordinate (keeping the second 
coordinate fixed). 

Mochon gives a rough interpretation of these moves in ||Moc07| . We can think of point raising 
as receiving a message, point merging as generating a message, and point splitting as checking 
a message via quantum measurement. These interpretations apply to the family of weak coin¬ 
flipping protocols in IIMocOSL and we show they also apply to BCCF-protocols. 

Below are some special cases of these moves which are useful when describing BCCF-point 
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games. 


Probability splitting: 
Probability merging: 

Aligning: 


{qi + 92) 




z, w 


Zl, Wl 


z, w 
f 92 
+ 92 


91 

z, w 

+ 92 

z, w 

z, w 

(91 + 92 ) 

z, w 


^2, W2 


91 


m . a . yi { zi , Z2 }, Wl +92 maxjzi, 2:2}, ^2 


Probability splitting is the special case of point splitting where the resulting points have the same 
value and probability merging is the special case of point merging where the resulting points have 
the same value. Aligning is just raising two points to the maximum of the two (usually so a merge 
can be performed on the other coordinate). 

We now show that each move in a BCCF-point game can be described using basic moves. 
Consider the first transition: 


r n 

1 

r 1 

1, 0 

+ 2 

0, 1 


E E 

fee{o,i} 2 /eB 


Vb,y, 0 


b£{0,l}y&B 


^b,y 1 


which can be described in two steps. First, 



E E 


b(l{0,l}y&B 


Vb,yi 1 


is just probability splitting followed by point raising (in the first coordinate). The transition 



E E 

b&{0,l}y&B 




is a point splitting. To see this, recall the dual constraint Diag(i;a) E for ® G {0,1}. 

We have seen that this is equivalent to the condition — f' when Va > 0, which is the 

condition for a point split. Technically, a point split would have this inequality satisfied with 
equality, but we can always raise the points such that we get an inequality. As explained earlier, 
we just call this a point split. 

We can interpret the point raise as Alice accepting Bob's last message b, and the point split as 
Alice checking Bob's state at the end of the protocol using her measurement. Note that these are 
the last two actions of a BCCF-protocol. 

We can do something similar for the second transition below 


EE^ +EE^ K. ij ^EEEr-(-,»)p{!/) 

by by a X y 

To get this, for every b G {0,1}, y G supp(/3f,), we point split 

‘^^n+l,x,y 


p{y,b) 




p{y) 


xGA 


^b,y 5 
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This is a valid point split since we have the dual constraint Diag 


2z, 


(y) 

n+1 


Pb,- 




b G {0, l],y G supp(/3b). Note that Zn+i does not depend on b so there are some consistency 
requirements when performing these splits. 

The points at this stage can be seen in Figure]^ for the special case of a four-round, i.e., n = 1, 
BCCF-protocol with |,4| = \B\ = 2 (noting thatp(y, b) = \l5b,y)- 


1 o ->->-1 « 


t 


Y 


A 


y 


<-<—• > > 

1 


1 


S E%'h.>»]+ E E^ 

ae{a,i}yeB ae{Q,i) yeB 




E E%^ 

ae{0,l}!/6S 


[^0,1 


+ E EE 

ae{Q,i} yeB xeA 


f^a^y^a,x 



2Z2^x,y 

Pa,y 


Figure 4: After the point splits in a BCCF-point game. 
For the other points, we perform the probability splitting: 


1 




b£{0,i}yeB 

yielding the current state 






fee{0,l}j/eBa:eA 




1 


E EE ^ ab,x ( p{y, b) I Vb,y, 01 p{y, b) 


be{0,l} y&Bx&A 

Merging the part in the brackets yields 


“^Zn+ly 


x,y 


f^b,y 


1 


Z ZZt"MP(2/) 


be{o,i} y&B x&A 


Vb,y, 


Zn+l,x,y 

p{y) 


E EE p{x,a)p{y) 

a&{0,l} y^B xeA 


^a,y’) 


p{v) \ ’ 


where the quantity on the right just relabelled b as a. The transitions here were point splitting, 
point merging, and point raising (from the dual constraint on Zx^y, we can think of it as being a 
maximum over a, corresponding to a raise). These correspond to Bob checking Alice, Bob gener¬ 
ating b, and Bob receiving a, respectively. 
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Fortunately, the rest of the transitions are straightforward. To explain the transition 


E EE p{x,a)p{y) 

aG{0,l} y^B xGA 




^n-\-l^x^y 

v{y) 


y&B xgA 


Wn,xi,yi,...,yn-i,Xn 

p{x) 


^n-\-l,x^y 

p{y) \ ’ 


all we do is merge a, then align pn G Bn in the first coordinate. To see why this is valid, we have the 
dual constraint > Eae{o,i} \oia,xVa,y = This corresponds to 

Alice generating a and receiving Bob's message Un G Bn- This is depicted in Figure]^ 



E EE p{x,a)p{y) 

a€{0,l} xGAyGB 



^2,x,y 

p{y). 


x£A y£B 


'^l,x ^2,x,y 

p{xy p{y) 


Figure 5: After the first two merges in a BCCF-point game. 


We show one more transition and the rest follow similarly. To show the transition 


^^p(x,2/) 
y X 


Wn,xi,yi,...,yn-i,Xn 

p{x) 


^n-\-l,x,y 

p{y) 


E 

yi yn-i X 


EE p{xi,yi, ■ ■ .,yn-l,Xn) 


W. 


n,xi,yi,...,y„-i,x„ 


Z, 


p{x) 


B.^X\ ^y\ ,— 1 j^/n — 1 

p(yi,... ,y„_i) J’ 


we merge on G Bn then align Xn G An in the second coordinate. The dual constraint corre¬ 
sponding to this is Zn,xi,yi_,...,xn-i,yn-i y ^n+i,x,y We Can Continue in this fashion until we 

get to the last points 


Y pixi) 

xi^Ai 


'^l,xi 

p(xi)’ 


where zi is Alice's dual objective function value. If we merge on xi, we get Bob's dual objective 


24 





































function value in the first coordinate 


zi 

xiGAi 


Therefore, if {wi,... ,Wn,vo,vi) is feasible for the dual of Bob's reduced cheating SDP and if 
{zi,... ,Zn, Zn+i) is feasible for the dual of Alice's reduced cheating SDP, then the final point of 
the point game is comprised of the two dual objective function values, as seen in Figure]^ 


1 o 


1 o 
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I 


X 


1 


1 


xeA 


'^l,x 

p{xY 


Zi 


wi,x, zi 

.x€A 


Figure 6: The last few moves of a BCCF-point game. 


Therefore, an optimal assignment of variables in the duals of the reduced cheating SDPs cor¬ 
responds to a minimal final point in the point game. We now argue that these duals attain an 
optimal solution. Since the optimal objective values are bounded above by 1, we can upper bound 
the values on all of the variables in the duals accordingly (it can be shown that Va,y < 2| A|, for all 
a € {0,l},y G B and the rest of the variables in the four duals are bounded above by 1). Also, they 
are bounded below by 0 from the positive semidefiniteness constraints. Since we are optimizing a 
continuous function over a compact set, we have that an optimal solution exists. 


We summarize this entire process as a list of basic moves in Point Game 4.4 
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Point Game 4.4 (BCCF-point game with final point 


[Cb, Ca] from basic moves) 


I [ 1 . 0 ] + I [ 0 . 1 ] 

ae{ 0 ,i} 




ae{o,i}yeB 


ae{0,l}y6B 

1 




a&{o,i}yeB 


0 , 1 


yy yy 4 ^^’y 

ae{0,l}y6B 

yy yy 

ae{0,l}y6B 

E E 

ae{0,l} y(^B x&A 


'^a,yi 0 


'^a,yt 0 


+ E E ^ 


ae{0,l}?/6B 


+ E EE>«. 


ae{o,i} yeB xeA 


^t'u.,yOla,x 


‘^Zn-{-l,x,y 


Ja,yi 


/I 

1 

1 


1 '^Pa,yCXa,x 

'^a,y! 0 



1 / 

p 



^Oa,a; 1 Pa,y 

'^a^yi 0 

+ I3a,y 



Pa,y 

‘^^n+l,x,y 


^a,y, 


ae{o,i} yeB x&A 

E E E 4““’^ i yy 

ae{0,l} y(^B x&A U6{0,1} 


/3a,y 

2-2^72+1,a:,y 




2^nH-l,a),y 

p{v) 


a,y, 


E EE p{x,a)p{y) 

ae{o,i} yeB xeA 

Wn,xi,yi,...,yn-i,Xn Zn+l,x,y 


^n+l,x,y 


p{y) 


yyyyp{x,y) 

yeB x&A 


p{x) ’ p{y) _ 


E E 

yi,...,yn-i xeA 


p(x,yi,.. .,yn-i) 


p{x) ’ p{yi,...,yn-i) 


prob. splitting 
point splitting 
point raises 
point splitting 
prob. splitting 


merges 


merge a, 
then align 

merge yn, 
then align 


^ E ^(^1) 

xiGAi 


Wl^xi 

p{xi )’ 


Ca 


1 [Cb) Ca] 


merge yi, 

then align xi 
merge xi. 


An example of an (optimal) BCCF-point game can be found in Appendix|^corresponding to a 
four-round BCCF-protocol with all four cheating probabilities equal to 3/4. Note this four-round 
protocol is equivalent to a three-round protocol in I1KN041 where we have set no = to make the 
first message "empty". 


4.2 Point game analysis 

From the point game description, we see that the only freedom is in how we choose the point splits 
since the rest of the points are determined from the merges and aligns. We expand on this idea 


26 













































when developing the succinct forms of the duals of the reduced SDPs in Subsection C.2 In each 
of the succinct forms of these duals, the only freedom is in how we choose to satisfy the positive 
semidefiniteness constraints. Once these variables are fixed, there is an obvious way to choose an 
optimal assignment of the rest of the variables. Coincidentally, the last constraints in each dual 
correspond to the point splits in the point game. 

This brings us to the following protocol independent definition of BCCF-point games. 


Definition 4.5 (BCCF-point game (protocol independent)) A BCCF-point game defined on the pa¬ 
rameters no, CHI £ Prob"^ and /3o, /3i G Prob"®, with final point [Cb, Ca]/ is any point game of the form 


1 


1 




Po :=2 

1 , 0 

+ 2 

0 , 1 

Pi ^ P2^ ■ 

^ Pm 


Cb, Ca , 


where the transitions are exactly the basic moves as described in Point Game 4.4 


As mentioned above, one only has the freedom to choose how the points are split at the begin¬ 
ning, the rest of the points are determined. Thus, every choice of point splitting yields a potentially 
different point game (keeping aQ,ai G Prob"^ and /3o,/Si G Prob^ fixed). A BCCF-point game is 
defined by no, «i G Prob^ and /3o, /3i G Prob^ which are the same parameters that uniquely de¬ 
fine a BCCF-protocol. However, there could be many point games corresponding to these same 
parameters. The analogous concept for BCCF-protocols is that there could be many cheating 
strategies for the same protocol. Of course, there is an optimal cheating strategy just as there is an 
optimal BCCF-point game. 

The above definition is protocol independent since we have defined starting points, an ending 
point, and a description of how to move the points around. Indeed, the "rules" for the point 
moves correspond exactly to dual feasible solutions with objective function values being the two 
coordinates of the final point. This yields the following lemma which is the application of weak 
and strong duality in the language of protocols and point games. 


Lemma 4.6 Suppose [Cb,i, Ca,o] (s the final point of a BCCF-point game defined on the parameters 
cxq , 0^1 G Prob"^ and f3o,/3i G Prob^. Then 


Fb,i < Cb,i and P^ q < Ca,o, 

where Pg ^ and P^q are the optimal cheating probabilities for Bob forcing 1 and Alice forcing 0, respec¬ 
tively, in the corresponding BCCF-protocol. Moreover, there exists a BCCF-point game with final point 

P* P* 

In this paper, we are concerned with bounding the bias of strong coin-flipping protocols, and 
therefore would like to bound all four cheating probabilities. Recall that Alice and Bob's two 
cheating probabilities are swapped when /3o and (5i are swapped. This motivates the following 
definition. 


Definition 4.7 (BCCF-point game pair) Suppose we have a BCCF-point game defined on the param¬ 
eters ao,ai G Prob"^ and /3o,/3i G Prob^ with final point [Cb,i, Ca,o]- Also, suppose we have another 
BCCF-pomf game defined by the parameters aQ,ai G Prob^ and /3q:=/3i, /3j:=/3o G Prob^ with fi¬ 
nal point [Cb,0) Ca,i]- call the two point games a BCCF-point game pair, defined by the parameters 
ao,ai£ Prob^ and /3o, /3i G Prob^, with final point [Cb,o, Cb.u Ca,o, Ca,i] • 
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It is worth commenting that BCCF-point game pairs are defined over certain parameters even 
though one of the point games in the pair is defined over swapped parameters. 

Using Lemma we have the following theorem. 

Theorem 4.8 Suppose [Cb, 0 ) Cb,i, Ca, 0 ; Ca,i] is the final point of a BCCF-pomf game pair defined on the 
parameters ao, oi G Prob"^ and /3o, /3i G Prob'®. Then 


P, 


B,o — Cb.O) Pb,i ^ Cb,i, P^fi ^ Ca,0; and Pf i < Ca,i, 


where Pg q, Pg Pf q, Pf ^ are the optimal cheating probabilities for the corresponding BCCF-protocol. 
Moreover, there exists a BCCF-point game pair with final point Pb o’ -^b i > -^A O’ -^A i • 


5 A related family of classical coin-flipping protocols 

In this section, we describe a family of classical protocols which is the classical counterpart to 
quantum BCCF-protocols. That is, we choose messages according to the underlying probability 
distributions (instead of in a superposition) and we have a modified cheat detection step at the 
end of the protocol. 

We now describe the protocol. 

Protocol 5.1 (Classical BCCF-protocol) 

• Alice chooses a € Aq uniformly at random and samples x ^ A with probability aa,x- 

• Bob chooses h ^ Bq uniformly at random and samples y € B with probability j3a,y 

• For ifrom 1 to n: Alice sends Xi G Ai to Bob who replies with yi G Bi. 

• Alice fully reveals her bit by sending a G Aq to Bob. If x ^ supp(aa). Bob aborts. 

• Bob fully reveals his bit by sending b G B^to Alice. Ify^ supp(/3fe), Alice aborts. 

• The outcome of the protocol is a © 6, if no one aborts. 

The rest of this section illustrates the cormections between this classical protocol and the quan¬ 
tum version. 


5.1 Formulating optimal classical cheating strategies as linear programs 

We can similarly formulate optimal cheating strategies in the classical protocols as optimization 
problems. In this case, we use linear programming as shown in the lemma below. 

Lemma 5.2 For the classical BCCF-protocol defined by the parameters ao,ai G Prob^, /3o) A G Prob^, 
we can write the cheating probabilities for Alice and Bob, each forcing outcome 0, as 

Pa, 0 ~ max < — ^ ^ ^ lda,ySa,x,y ■ ('Slj ■ • • ; 'Sn; '?) G Pa / ; 

a^A'^yeB x&upp{aa) ) 
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and 


^B, 0 =max<|^^ ^ ^aa,xPn,x,y ■ {pi,- ■ ■ ,Pn) , 

asAJ, i/esupp(/3a) xeA j 

respectively. We obtain ^ and Pg ^ by switching the roles of /3o and /3i. 

Proof We shall prove this for the case of cheating Bob as the case for cheating Alice is almost 
identical. By examining Alice's cheat detection, we see that if we switch the roles of /3o and fdi 
then we also switch Pg q and Pg so we only need to prove the Pg q case. 

After receiving the first message from Alice, Bob must choose a message to send. He can do 
this probabilistically by choosing yi G Pi with probability pi^xi,yi, yielding the first constraint in 
Bob's cheating polytope. Notice that his message can depend on Alice's first message. We can 
similarly argue that the probabilities with which he chooses the rest of his messages are captured 
by the rest of the constraints in the cheating polytope with the exception of the last message. For 
the last message, we assume that Bob replies with b = a, where a G Aq was Alice's last message, 
if he desires outcome 0 and b = d otherwise. Therefore, this decision is deterministic and is not 
represented by the cheating polytope. 

All that remains is to explain the objective function. Since Bob chooses his last message de¬ 
terministically, the quantity \aa,xPn,x,y is the probability that Alice reveals (x, a) and Bob reveals 
{y, a). If he reveals y when f3a,y = 0, he gets caught cheating, otherwise, his choice of b is accepted. 
Therefore the objective function captures the total probability Alice accepts an outcome of 0. □ 

These are very similar to the quantum cheating probabilities except for the nonlinearity in the 
objective functions. For example, in the quantum setting, cheating Alice's objective function is 

- ^/3a, j/ and for the classical setting, it is - Y 

a&{0,l}y£B a&{0,l}y£B 

where esupp(Q,^) is the 0,1-vector taking value 1 only on the support of We have a similar 
observation for Bob. What is surprising is that we can capture the communication for both settings 
with the same polytope. 

To better understand this connection, we can write the objective function of Alice's reduced 
cheating SDP (for the quantum case) as 

ae{0,l}?;es 

Then the objective function for Alice's cheating LP can be recovered if we replace with 

Diag(esupp(Q,^)). Suppose we define a new projection 

nB,o := |a)(a| (g) |a)(a| (g) Diag(esupp(„^)) (g) I^/. 

ae{0,l} 

A quick check shows that we can repeat the entire proof of the reduced cheating problems (in 
the quantum case) with this new projection if we also replace each occurrence of ^/oPl^/oLff' with 
Diag(esupp(Q,^)). Similar statements can be made if we redefine the other projections as 

nB,.:= E |a)(a| (g) |a)(a| (g) Diag(esupp(c,^)) (g) I^/, 

ae{0,l} 
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Ha.O |a)(a| (g) \a){a\ (g) Diag(esupp(^^)) (g) 1a', 

ae{0,i} 

nA,i:= E |a)(a| 0 |a)(a| 0 Diag(e<,upp(^^)) 0 Ia'- 
ae{0,i} 

This provides two insights. First, it proves that if we weaken the quantum cheat detection, we 
recover the optimal cheating probabilities for the corresponding classical protocol. Second, it gives 
us a recipe for developing the point games for the classical version. Notice that the eigenvalues 
of the dual variables are the same as in the quantum case, it is just that we have the stronger 
constraints: 

Diag(?;a) ^ Diag(esupp(^_)) compared to Diag(ua) ^ 

Diag(45i) ^ 5/3a,yDiag(esupp(„^)) compared to Diag(4^_Jj ^ 

Any solution of the constraint on the left satisfies the respective constraint on the right since 

Diag(esypp(^-)) ^ \/13 a \/13 a and —j3a^y^i&s{('Supp{aa)) — 2 \/^a ■ 

Since the dual feasible regions are smaller in the classical case, we get that the optimal objective 
value cannot be less than the quantum version since they share the same objective function. This 
makes sense since the classical protocol has a weaker cheat detection step and we could have larger 
cheating probabilities. We can think of the classical case having more general strategies since the 
cheat detection step in the quantum version rules out certain strategies from being optimal. In this 
sense, the classical primal feasible regions are larger than those in the quantum version and the 
classical dual feasible regions are smaller. This is similar to the relationship between the duality 
of convex sets. We have that Ci C C 2 implies Cf 0 and the converse holds if Ci and C 2 are 
closed convex cones. This relationship is depicted in Figure]^ 

Classical Quantum 




Figure 7: Relationship between the primal and dual feasible regions of the quantum and classical 
cheating strategy formulations. 
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5.2 Point games for classical BCCF-protocols 

In this subsection, we develop the classical analog to the quantum BCCF-point games. Using 
these "classical point games", we prove that at least one party can cheat with probability 1 in any 
classical BCCF-protocol. A closer analysis shows that both cannot cheat with probability 1, which 
holds true for quantum BCCF-protocols as well. 

Since point games are defined in terms of dual SDPs, we use the above embedding of the 
classical cheating LPs into SDPs to construct classical BCCF-point games. Due to the similarities, 
very little about the quantum BCCF-point games needs to be changed to attain classical BCCF- 
point games; we only need to change the definitions of Alice and Bob's projections. Of course, the 
dual solutions may be different due to the stronger constraints for the classical version. The only 
differences are in the first few points (corresponding to the last few steps in Kitaev's proof that 
involve the projections). A quick calculation shows that these points are the same as well. The 
reason for this is because, in Bob's projections, we replace |V'a)(V’a| with Diag(esupp(a„)) <8) Ia', but 
they have the same inner product with the honest state of the protocol 


(IV'a)(V'a|,|V’a)(V’a|) = (I V'a) (V'al, Diag(esupp(„^) ) (g) Ia') = 1. 


A similar argument holds for Alice's projections as well. 

Thus, the only difference between the classical point games are the values of the points, which 
are derived from slightly different dual constraints. Let us examine the point splits. In the quan¬ 
tum case, these are derived from the constraints 

Diagjva) ^ and Diag( 2 ;^^J ^ , Va G {0, l},y G B. 

In the classical case, the corresponding constraints are 

Diagjwa) ^ Diag(esupp(/3,,)) and Diag(4+i) ^ ^/?a,j/Diag(esupp(„^)), Va G {0, l},y G B. 

It is easy to see that Va = esupp(^-) and 




= < 


5/3o,j/ if X G supp(ao) \ supp(ai), 
if X G supp(ai) \ supp(ao); 
i max,jg| 0 A}{^a,j/} if x G supp(ao) n supp(ai), 

0 otherwise. 


are optimal assignments of these variables. Recall the two point splittings: 


1, 0 


^a^y) 0 

and 





6e{o,i}yes 




xGA 

*- 


/3a,y 


We see that these are just probability splittings using the optimal assignment above (with possibly 
a point raise in the case of x G supp(ao) Fl supp(Q;i)). These probability splittings are in contrast 
to the point splittings in the quantum case. The rest of the constraints are the same as in the 
quantum case and correspond to point merging, probability merging, and aligning. Therefore, the 
only difference between quantum BCCF-point games and the classical version is that non-trivial 
point splittings are allowed in the quantum version. Therefore, we get the following definition. 
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Definition 5.3 (Classical BCCF-point game (protocol independent)) A classical BCCF-point game 
defined on the parameters ao,ai £ Prob"^ and /3o,/3i G Prob"®, with final point [Cb, Ca], is a quantum 
BCCF-point game defined by the same parameters and having the final point [Cb, Ca] but the point split¬ 
tings are trivial (i.e., they are probability splittings). 


Using this definition, we define classical BCCF-point game pairs analogously to the quantum ver¬ 
sion. 


To complete the picture, we now present the classical version of Theorem 4.8 


Theorem 5.4 Suppose [Cb.Oj Cb,i , Ca,0) Ca,i] the final point of a classical BCCF-point game pair defined 

on the parameters ao,ai G Prob"^ and /3o, /3i G Prob^. Then 


Tb,o — Cb,0) Pb,! — Cb,1) Pa,o — Ca,0) Pf i < Ca,1) 


where Pg q, Pg Pf q, Pf ^ are the optimal cheating probabilities for the corresponding classical BCCF- 
protocol. Moreover, there exists a classical BCCF-point game pair with final point Pb o) ^b i ’ ^A o > ^A i • 

Figure [^depicts the intricate connections between quantum and classical BCCF-protocols and 
their point games. 


Duality 

Primal G-P Dual 


(Quantum) SDP/SOCP 



Duality 


(Quantum Protocop 


Polytope 


Setting 

Measurement 


( Bobs Dual SDF^ Solutions 


(Quantum Point Game ) 


(Alice’s SDP) - (Alice’s Dual SDP) 

Restricted F.R. 


(Classical) LP 



(Classical Protocop 


Point Splitting 


(Vlice’s LP) - (Alice’s Dual LP) 


Figure 8: Crystal structure of BCCF-protocols. F.R. denotes "feasible region". 

This crystal illustrates an analogy between physical theories and certain classes of convex op¬ 
timization problems. More specifically, we see that the generalization of classical mechanics to 
quantum mechanics is analogous to the generalization of linear optimization to semidefinite op¬ 
timization. In the rest of this subsection, we elaborate on this idea and explain the benefits of 
viewing cryptographic protocols with this perspective. 

It was shown in INST14I that the cheating SDPs can be written as SOCPs. The fact that the 
cheating in our protocols can be modelled as second-order cone programs hints that our protocol is 
using only a well-structured "part" of quantum mechanics. Indeed, apart from the initialization of 
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the states at the beginning and the measurements at the end, our protocols only exchange quantum 
systems. Thus, our protocols are conceptually not using every aspect of quantum mechanics at 
every opportunity Furthermore, the fact that the reduced problems are "almost linear programs" 
hints that our protocols are "almost classical", which is indeed the case. As we have discussed, 
only the measurement at the end makes the BCCF-protocol "quantum". Thus, there is some 
philosophical connections between how "quantum" the protocol is and how "SDP" is the cheating 
formulation. This is a purely philosophical statement, of course, but it could provide insights 
towards protocol design. For example, in IIMoc07l , it was shown how to create quantum weak 
coin-flipping protocols with arbitrarily small bias using SDPs. Since the structure of his protocols is 
implicit in the analysis and is very complicated, perhaps a better understanding of the SDPs used 
could shed light of the specific quantum mechanical behaviours to look for in designing such a 
protocol. 

On a more quantitative side, once could use optimization theory to provide a measure of the 
complexity of a protocol. For example, in IINST14L we provide an SOCP representation for the 
hypograph of the fidelity function (characterizing the cheating probabilities in the reduced prob¬ 
lems). Recall that the hypograph of a concave function is a convex set. Also, the dimension 
of the hypograph of F(,g) : M” —)■ M is equal to n (assuming q > 0). Since the hypograph is 
0(n)-dimensional and convex, there exists a self-concordant barrier function for the set with com¬ 
plexity parameter 0{n), shown by Nesterov and Nemirovski INN94i . The details of such func¬ 
tions are not necessary for this paper, but we mention that such a function allows the derivation of 
interior-point methods for the underlying convex optimization problem which use 0{y/n log(l/e)) 
iterations, where e is an accuracy parameter. This suggests that we can use the complexity param¬ 
eter of the self-concordant barrier function of the objective function characterizing cheating in 
the protocol as a complexity measure for the protocol. Such a measure could also lend itself to 
more general theories. For example, if one were to consider coin-flipping in a theory generalizing 
quantum mechanics, then one could still measure the complexity of the protocol by considering 
the complexity parameter of the objective function in a class of optimization problems possibly 
generalizing semidefrnite optimization. Considering this paper uses restrictions of semidefrnite 
optimization to characterize sub-quantum behaviour, it would not be surprising if generalizations 
of semidefrnite optimization would characterize super-quantum behaviour. 


5.3 Security analysis of classical BCCF-protocols 

We start by giving an alternative proof that these classical protocols have bias e = 1/2 using the 
language of point games. 


Lemma 5.5 Suppose we have the following point game 


Po ■= 




-^Pi^ - Pm-i Pm 


Cb, Ca , 


where each move is either point raising, point merging, probability merging, or probability splitting. Then 
Cb > 1 or Ca > 1- 


Proof Suppose for the purpose of contradiction that Cb, Ca < 1 and let i G {1,..., m} be the 
smallest index such that pi has a point of the form [Cb.i, Ca.i] with CB,i,CA,i < 1- Since pi-i has 
no such points, [Cb.i, Ca,*] could not have been generated from a point raise, a probability merge. 
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nor a probability split. Thus, pi-i —)• pi must be a point merge and suppose without loss of 
generality, it acted on the first coordinate. Then pi-i has two points qi [Ci, CA,i] and q 2 [C 2 , Ca.i] 


with 


Qi Cl + Q 2 C 2 


qi + q2 

choice of i. □ 


= CB,i < 1 implying Ci < 1 or C 2 < 1 / a contradiction to the minimality of the 


Using the above lemma and Theorem |5.4[ we have that classical BCCF-protocols are insecure; 
at least one party can cheat with probability 1 . 

There are two special cases of classical protocols we consider in greater detail. Recall the points 
in the point game (before merging on a in the first coordinate) 


E EE p{x,a)p{y) 

ae{o,i} yeB xeA 




^n+l,x,y 

v{v) 


( 1 ) 


The first case we consider is when ao, oi, /3o, /3i > 0. Then we can set Va,y = 1 for all a G {0,1}, 
y G B and Zn+i,x,y = 5 niax^gio,!} I3a,y for aW x G A,y G B. After the merges and aligns, we have 
the final point being 




y&B 


1 ) 2 


using Lemma 2.5 We can see that this is a BCCF-point game with an optimal assignment of 


dual variables. Thus, Bob can cheat towards 1 perfectly and Alice can force 0 with probability 
^ + ^A(/io, /3i) as seen on the left in Figure]^ These two quantities are invariant under switching 
/3o and /3i, thus Tg q = Pg ^ = 1 and q = Pa 1 = 5 + The corresponding optimal 

cheating strategies in the classical BCCF-protocol are obvious by noticing the cheat detection step 
does nothing when the vectors have full support. Bob can send anything during the first n mes¬ 
sages and then return b = a. Alice can send a corresponding to her best guess of b from her 
information about y G B, i.e., she can cheat with the probability she can infer b from y G B. An 
interesting observation is that this is a valid point game pair for both the classical and quantum 
versions for any no, ai G Prob"^ and /3o, /3i G Prob^ since the dual feasible regions for the classical 
formulations are contained in the dual feasible regions of the quantum formulations. Therefore, 
we have that Pa o> Pa 1 — 5 + /5i) for every quantum BCCF-protocol as well. This bound 

can be interpreted as follows. Suppose we change the order of the messages in the BCCF-protocol 
in Alice's favour, so that Bob's first n messages are sent first, followed by all of Alice's messages, 
then finally Bob's last message. Then Alice's new cheating probability would be ^ + 5A(/3 o, Pi) 
and is an obvious upper bound on the amount she can cheat in the original protocol (since she gets 
information about b sooner than intended). This argument works for the classical and quantum 
versions. 

It may seem that classical protocols favour a cheating Bob, but this is not always the case. 
Consider the case when Pq T Pi and ao,ai > 0. Then = 1 for all y G supp(/3o) U supp(/3i), 

thus the second coordinate equals 1 for all points in Q, and remains that way until the end of 
the point game. This proves Alice can cheat with probability 1, which is obvious since Bob's first 
message fully reveals b and she can always pass the cheat detection step. The extent to which Bob 
can cheat depends on the choice of oq and ai and can be calculated as 




max 

ae{ 0 ,l} 


E 

X2£A2 


2^0'A ~ 2 2^ (P^A 2 > 

Xn&An 


<A„(ao)) TrA2x---xA„(ai)) > 
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using Lemma [23} This is a distance measure between the two marginal distributions over Alice's 
first message xi. This point game is depicted on the right in Figure}^ Bob can cheat with this 
probability since he can choose b equal to his best guess for a from his information about xi. 
Once his first message is sent, he must keep his choice of b or he will be caught cheating with 
certainty. These cheating probabilities do not depend on /3o or /3i, so we have q = = 1 and 

^B,o = ^B,i = ^ + ^^(Tr-A 2 x -xyi„(ao),Tr, 42 x .xyl„(ai))- Therefore, a classical BCCF-protocol 
could favour either party 


1 


[| + 5A(TrA2x-xyl„(ao).Ti'A2x-xyl„(ai)), l] 


1 




A 


X [1,^ + ^A(/3o,/3i)] 


1 1 

Figure 9: Classical BCCF-point game examples. Left: A classical BCCF-pomt game favouring 
cheating Bob. Right: A classical BCCF-point game favouring cheating Alice. 

This raises the question: Can we find a BCCF-protocol such that both parties can perfectly 
control the outcome? We now argue that no such classical, and hence no such quantum, BCCF- 
protocol exists. Suppose for the purpose of contradiction that this is the case. Then we must have 

1 = Pa,o — 2 ^ 

which implies /3o -L /3i. Then the only way for Bob to cheat with probability 1 is to have complete 
information about a after Alice's first message, implying the orthogonality condition 

Tryi2x---x2l„(Q:o) -L TV,42x--xy4„(ai)- 

This can only be the case when ao _L ai and in this case, as we have argued before, that Alice must 
stick to her choice of a after her first message. Since she has no information about b before the start 
of the protocol, she can only cheat with probability 1/2, a contradiction. 

Therefore, there is no classical BCCF-protocol where both Alice and Bob can cheat perfectly, 
and hence no quantum protocol. Along with the fact that classical protocols are insecure, this 
proves the following theorem. 

Theorem 5.6 In every quantum BCCF-protocol, at most one party can cheat with probability 1. In every 
classical BCCF-protocol, exactly one party can cheat with probability 1. 
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6 Using classical protocols to lower bound the quantum bias 


In this section, we prove that no quantum BCCF-protocol can have bias e = 1 /a/ 2 — 1/2. More 
specifically, we prove that only protocols that share optimal cheating probabilities with their clas¬ 
sical counterpart can saturate Kitaev's lower bound on the product of the cheating probabilities. 
This shows yet another connection between quantum and classical BCCF-protocols. 

We start with rederiving Kitaev's lower bound using the reduced SDPs. The duals of Bob's 
and Alice's reduced SDPs, each for forcing outcome 0, are 


inf TrAi(^«i) 



inf zi 



s.t. wi®eB^ 

> 

TrA2('W2), 

s.t. Zl ■ CAi 

> 


W2 ® e_B2 

> 

TrA3(u>3), 

Z2 (8) 6^2 

> 

T^B2iz3), 

Wn ® eB„ 

> 

5 Z]ae{0,l} ““ ® ^01’ 

Zn (8) eA„ 

> 

TtB„iZn+l) 

Diag(i;a) 


, Va, 

Diag{zY) 




Va,y, 


respectively. Let {wi,... ,Wn,vo,vi)he optimal for Bob's dual above and let (zi,..., Zn+i) be opti¬ 
mal for Alice's dual above. We have 


Pb, 0 ^ 1,0 = = (TrAi(w'i),zi) = {wi,zi ■ e^i) > (rci,TV b^(^2)) = {wi ®eB^-,Z 2 ). 

In a similar maimer as was done in Section]^ we can alternate through most of the vector inequal¬ 
ity dual constraints to show that 


Pb,oPa ,0 > {Wn ® eB^,Zn+l). 

We bound the quantity {wn ® es„, using the rest of the dual constraints, albeit in a slightly 
different manner. We decompose Zn+i = Yly&B ^n+i ® dual constraints 

to get 


{Wn® eB„.,Zn+l) > 


> 


> 


1 

2 

1 

2 

1 

2 

1 

4 

1 

4 

1 

4 

1 

2 


ae{o,i}yes 


E E (V^V^"^)Diag(z ISi))(Diag(i;a),eyeJ) 

ae{ 0 ,l}y 6 B 

ae{o,i}yes 

Y (Diag(i;a),Diag(/3a)) 
ae{0,i} 


Y (Diag(i;a), 

ae{0,i} 


Yj (V^V^ ) \fiia\fiia ) 

ae{0,l} 
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Therefore, we get Kitaev's lower bound o^b o — implying that o — ^-^b o — ^/ 

We get the inequality -Pa i-^B i > 1/2 by switching (3o with /3i in the proof above (and the dual 
variables accordingly). 

Using these two lower bounds, we show that it is impossible to have a quantum BCCF- 
protocol with bias e = l/\/2 — 1/2 by proving Kitaev's bounds can only be saturated with proto¬ 
cols where one party can cheat perfectly More specifically, we show that if there exist four dual 
solutions that saturate both of Kitaev's bounds 

n,o^’B,o>V2 and Pl,Pl,> 1/2, 

then all four of the dual solutions must also be feasible in the duals of the classical versions. 

Theorem 6.1 Suppose a quantum BCCF-protocol satisfies PXqPbo ~ -^a i -^b i = 1/2- Then 

the cheating probabilities are the same as in the corresponding classical protocol defined on the same param¬ 
eters. 

Proof By looking at the proof of Kitaev's bound above, we see that if it were saturated, then ev¬ 
ery inequality must hold with equality. Therefore, we know Diag(tJa) P has no slack 

on the subspace spanned by , i-e., (Diag(t;a) - ■, ) = 0, or equiva¬ 
lently, (Diag(r;a), = 1, for both a £ {0,1}. Consider Va = egupp(^^) which satisfies 

Diag(va) P and the condition (Diag(va), \fWa\fWa ) = 1- We show this choice is unique 

(on supp(da))- Consider the optimization problem 

inf |(Diag(na), \fWa\fWa ) : Diag(t;a) P 

= inf i ^ 'Va,yfia,y ■ ^ < 1, Va,y > 0 

l,?/esupp(/3o) J/esupp(/3a) 

Obviously Va = esupp(^^) is an optimal solution since 1 is a lower bound on the optimal objective 
value. Suppose there are two different optimal solutions v' and v”. Notice that \v' + \v" has the 
same objective value, but satisfies the constraint Y^y^suppiPa) ^ with strict inequality since 

the function X]ygsupp(/3a) strictly convex. Thus, we can scale ^v' -|- ^v" to get a better objective 
function value, a contradiction. Therefore, if Kitaev's bound is saturated, we must have Va,y = 1 
for all a £ {0,1}, y £ supp(/3a)- 

We argue the same about Alice's dual variables If Kitaev's inequalities are saturated, 

we have Diag(4+i) - ^|3a,y^/^^/dpY) = 0, or just, 

for all a, y such that Va,y > 0, i.e., for all y £ supp(/3a)- Similar to the arguments above, we need 

[Znli]x = \fia,y for a £ {0,1}, X £ suppjoa), and y £ supp(/3a)- 

To summarize, if we have Kitaev's bounds saturated, then the optimal dual solutions satisfy 
Diagjwa) P Diag(egupp(^j) and Diag(2:i^_J J ^ \l3a,y Diag(esupp(oj), for all a £ {0, l],y £ B, which 
are exactly the constraints in the dual LPs for the classical version. Therefore, the protocol must 
have the property that relaxing the cheat detections in nA,o and nB,o (obtaining the classical cheat 
detections) preserves the two cheating probabilities. We can repeat the same argument with Al¬ 
ice and Bob cheating towards 1 and get the two corresponding classical cheating probabilities. 
Therefore, we have all four cheating probabilities are equal to those of the corresponding classical 
protocol, as desired. □ 
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Since every classical protocol allows one party to cheat perfectly, we obtain Corollary |1.5[ that 
e = l/-v/2 — 1/2 is impossible for any BCCF-protocol. 

The proof of Theorem 6.1 gives necessary conditions on classical protocols that saturate Ki- 
taev's bound. Note from the condition on we have [zn+i]x,y = \l^a,y when I3a,y,aa,x > 0. 
In the case when ao,ai, l3o, jSi > 0, then /Iq must equal /3i. This makes sense since Bob can easily 
cheat with probability 1, but if /3o / /3i, then Alice could cheat with probability greater than 1/2. 
In the case when oq -L « 1/ the condition above tells us nothing, but it is easy to see that Alice 
fully reveals a in the first message, thus she can cheat with probability 1/2 and Bob can cheat with 
probability 1. 


7 Conclusions 

We studied the security of quantum coin-flipping protocols based on bit-commitment utilizing 
SDP formulations of cheating strategies. These SDPs allowed us to use concepts from convex 
optimization to further our understanding of the security of such protocols. In particular, using a 
reduction of the SDPs and duality theory, we were able to find the classical protocol counterpart 
and develop a family of point games corresponding to each of the classical and quantum protocols. 

Using the cormections between classical and quantum BCCF-protocols, we were able to show 
that a bias of e = 1 /^/2 — 1/2 is impossible for BCCF-protocols using a modified proof of Kitaev's 
lower bound. 

An open problem is to find the optimal cheating strategies for a general n-round BCCF- 
protocol. This can be accomplished by finding closed-form optimal solutions to the cheating SDPs 
or the reduced cheating SDPs. Very few highly interactive protocols, such as BCCF-protocols, 
have descriptions of optimal cheating strategies and therefore having such for this family of pro¬ 
tocols would be very interesting. 

A benefit of knowing the optimal strategies would be to help resolve the problem of finding 
the smallest bias for BCCF-protocols. In INSTITI , we analyzed BCCF-protocols from a com¬ 
putational perspective. We computationally checked the bias of over 10^® four and six-round 
BCCF-protocols and based on the findings we conjecture that having all four cheating probabili¬ 
ties strictly less than 3/4 is impossible. 

A related open problem is to find an explicit construction of optimal protocols for coin-flipping 
and bit-commitment. We can accomplish both of these tasks by finding an explicit construction 
of optimal weak coin-flipping protocols (see IICK091 ICKlll l. so this would be very rewarding. 
Technically, such a construction is implicit in HMoc07L however it involves many reductions and 
is quite complicated. 
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A Coin-flipping and Kitaev's protocol and point game formalisms 

Kitaev developed point games from his SDP formulation of cheating strategies for coin-flipping 
protocols. Here, we review the construction in UMocO/l . see also llACG+141 . 

We start with a general setting for a coin-flipping protocol. This setting has a space devoted 
for messages and each message has the same dimension. This is done for convenience as it makes 
the analysis in this section simpler. 

A coin-flipping protocol can be described by the following parameters: 

• The number of messages, denoted here as n. We can assume n is even, 

• three Hilbert spaces: Alice's private space C^, a message space C^, and Bob's private space 

C^, 

• a set of unitaries {Ua,i, Ha, 3 ,..., UA,n-i} acting on . These correspond to Alice's mes¬ 

sages to Bob, 

• a set of unitaries {Hb, 2 , Hb, 4 , ..., Hb,^} acting on These correspond to Bob's messages 

to Alice, 

• a projective measurement on for Alice (nA,o, IIa,!, Ha, abort) determining Alice's protocol 
outcome, 

• a projective measurement on C'® for Bob (Hb.Oj TIb,i, TIb, abort) determining Bob's protocol 
outcome. 

The protocol proceeds as follows. Alice initializes the space to |t/'A,o) arid Bob initializes 
(^MxB and sends to Alice. Then Alice applies her first unitary Ua,i and 

sends to Bob. Then he applies his first unitary Hb ,2 and returns to Alice. They repeat 
this until Bob applies his last unitary UB,n- Then they both measure their private spaces to get the 
outcome of the protocol. This process is depicted in Figurej^for the case of n = 4. 

The protocol parameters must satisfy the requirements: 

1. Alice and Bob do not abort when both are honest. 

2. They output the same bit when they are honest, and that bit is randomly generated. 

If we let I'tpn) £ i[^AxMxB state at the end of the protocol when Alice and Bob are honest, 

both requirements are satisfied when 

(FIa.O <8) Im ® FIb.O, |V’n)(V'n|) = (IIa,! ® Im ® TIb, 1, |V'n)(V’n|) = (2) 
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(J-M (J-B 

IV^^.o) \i'M,o) \i’B,o) 



{nA, 0 ; nA,l) nA^abort} {1^3,0) ^ 31 , n3^abort} 

Figure 10: Four-round coin-flipping protocol. 


A.l Cheating SDPs 


We can calculate the extent cheating Bob can force honest Alice to output a fixed desired outcome, 
say c G {0,1}, by solving the following SDP: 


P^c = max 

subject to 


(HAjCi pA^n) 

— 

|V’A,o)(V'A,o|, 


PA,i 

= 

PA,i-l, 

for all i even, 

TvMipA^i) 

= 

PA,ii 

for all i even, 

PA,i 

= 

TrAf f[/A,iPA,i-lf^A,i') 5 

for all i odd, 

PA,i 

G 


for all z. 

PA,i 

G 


for all i even. 


The variables describe the parts of the quantum state under Alice's control during different times 
in the protocol as depicted in Figure]^ The constraints model how much cheating Bob can change 
the current state of the protocol in each message and the objective function is the probability Alice 
accepts outcome c G {0,1} by measuring the state she has at the end of the protocol. 
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We get a very similar SDP for cheating Alice by switching the projections and interchanging 
the "odd" constraints with the "even" ones: 


= max 

subject to 


{^B,c,PB,n) 

Pb,o 

— 



PB,i 

= 

PB,i-l, 

for all i odd, 

^M{PB,i) 

= 

PB,i, 

for all i odd, 

PB,i 

= 

TrM (UB,iPB,i-lUB,'^ ! 

for all i even 

PB,i 

G 


for all i, 

PB,i 

G 


for all i odd. 


The variables for a cheating Alice are also depicted in Figure These SDPs are referred to as 
Alice and Bob's cheating SDPs. 




(j-M 




PAfi 

PAfl 

PA,1 
PA,2 
PA,2 

PA,3 

PA,A 


\i’A,Q) |'0M,o) |^B,o) 



Pb,q 

Pb,i 

Pb,i 

PB,2 

PB,3 

PB,3 

Pb,a 


{nA,0) Ha,!, n A, abort} 




Figure 11: Four-round corn-flipping protocol with SDP variables depicted. 
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The duals of the above SDPs are as follows: 


and 


inf (2 ’a,o, |V’A,o)(V’A,o|) 
subject to ZA,i-i (8 ) Im 

ZA,i-l 

ZA,n 


^ UA^i{ZA,i'ZilM)UA,i, 

= Za,!, 

— TIa,c) 


for all i odd, 
for all i even, 


inf 

subject to 


{Zb,o, \'4’b,o){'4’b,o\) 
ZB,i-i ® Im 
ZB,i—l 

ZBjU 


Zb^ii 
= IIb.c- 


for all i even, 
for all i odd. 


We can derive a lower bound on the bias of any strong coin-flipping protocol by examining 
feasible dual solutions. Since the dual SDPs have strictly feasible solutions and the objective func¬ 
tion is bounded on the feasible region, there is zero duality gap. Therefore, for Alice and Bob 
forcing outcome 0, and for any 5 > 0, we can find feasible dual solutions [Zba, ■ ■ ■, ZB,n) and 
{Za,o, ..., ZA,n), such that 


-^1,0 + > {Zb,o, |V's,o)(V’b,o|) and q -|- d > {Za^, \i>Afl){i> a,o\)■ 

Therefore, we have 


(^B,0 +'^) (-fA,0 +'^) > (-^5,0, |V'S,o)('0B,o|)(^A,O, |V'A,o)('0A,o|) 

= {ZAfi ® Im ® Zba, |V'A,o)(^/’A,o| ® |V’M,o)(V’M,o| ® |V'b,o)(V'b,o|) 

= (^A,o ® Im <8-^5,0) |'*/'o)(V'o|)) 

where we define IV'o) to be the state at the beginning of the protocol when Alice and Bob are 
honest. Let |V’i) be the state after Bob applies U-Q^i in an honest run of the protocol for i even. We 
have from the dual constraints, for i even. 


{ZA,i ZB,i, |V’i)(V’i|) 

> (17X,i+l(-^A,i+l ® lM)LA,i+l ® ZB^i, |V’i)(V'i|) 

= {ZA,i+l ® Im ® ZB,i, {UA,i+l ® Is)|'0i)(V’*l(I^A,i+l ®Ib)) 

= {ZA,i+2 ® Im ® ZB,i+l, {UA,i+l ® Is)|V’i)(V’*l(I^A,i+l ® Ifi)) 

> {ZA,i+2 ® b^B,i+2(lM ® ZB,i+2)UB,i+2i {UA,i+l ® Ib)I V'i)(V'il (I^A,i+l ® Is)) 

= (■^A,i+2 ® Im ® ZB,i+2^ \'>Pi+2) {'>Pi+2\) ■ 

We can compute 

{ZA,n ® Im ® Zb^u, |'0n)(V’n|) = (nA,0 ® Im ® Hb.O, |V'n)(V'n|) = 1/2, 

from condition (j^. Taking the limit as <5 —)■ 0, we get 

Pb,qP1,o > 2 ™^^{-fB,0)-lA,o} ^ ^ ^ ~ 2' 

This lower bound was later reproven by Gutoski and Watrous IIGW07II using a different represen¬ 
tation of quantum strategies. 
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Notice that we can reproduce the proof above using dual feasible solutions for Bob cheating 
towards 1 and Alice cheating towards 0. In this case, we get the final condition 

{ZA,n ZB,n, I'lpn) {lpn\) = (IIa.O <8) Im ® IIb,!, \'>Pn) = 0. 

This gives a trivial bound on the product of the cheating probabilities. However, Kitaev used this 
to create point games which we discuss below. We refer the reader to BMocO/l for the full details 
of the construction of general point games as all the details are not needed for this paper. 


A.2 Point games 

Let eig{Z) denote the set of eigenvalues for an operator Z and let 11^^ denote the projection onto 
the eigenspace of Z corresponding to eigenvalue A G eig(Z). For a quantum state a G S”, and 
X,Y £ S", denote by Prob(A, Y, cr) : —>• M+ the function 


Prob(A, Y, a) 


E E 

Aeeig(Js:) ^J,eeig{Y) 



where we use the notation [A, /i] : ^ M to denote the function that takes value 1 on input (A, p) 

and 0 otherwise. Note this function has finite support. Using this definition, we can create a point 
game from feasible dual variables as follows 


Pn-i := Pj:oh{ZB,i, ZA,i,TvM\A){'>Pi\), 

recalling that |V’i) G is the state after Bob applies UB,i in an honest run of the protocol. 

Consider the dual SDPs for weak coin-flipping, i.e.. Bob trying to force outcome 1 and Alice trying 
to force outcome 0. We can calculate po = 5 [O, l] + ^ [!> O], which acts as the starting point of the 
point game. Notice for any 5 > 0, there exists a large constant A such that 

Za,o{^) ■= {{'tpA,o\ZA,o\'lpA,o) +^) |V'A,o)(V’A,o| + A (I - |V’Ao)(V’A,o|) ^ ^A, 0 , (3) 

which can be proved using the Schur complement after writing Za,o in a basis containing {ipAfi)- 
Notice {ZAfl{S), Za,i, ■ ■ ■ , ZA,n) is feasible if (Zap, Za,i, ■ ■ ■, ZA,n) is feasible and has the same ob¬ 
jective function value as <5 —)• 0. If we replace Zap with Zap{S), and replace Zbp with the properly 
modified definition of Zbp{S), we get that the final point is 


Pn = 1 


ii^AplZApli^Ap) + 5 , {iPbp\Zbp\iPbp) + (5 


By strong duality, we see that we can choose the dual feasible solutions and 6 such that this final 
point gets arbitrarily close to Pb i > o 


A point game po —^ Pi —> • • • —^ Pn with final point [Cb , Ca] can be defined independent of 
protocols. Define [x] : M —^ M to be the function that takes value 1 on input x and equals 0, 
otherwise. Then po —)• pi —)••••—)• pn is a point game with final point [Cb, Ca] / if each p* is a 
function with finite support, po = ^ [O, l] -|- ^ [l, O], pn = 1 [Cb, Ca] / and the moves (or transitions) 
Pi -A pi+i have one of the following forms (possibly acting on only a subset of the points) 


asA 


xa, y 


^ ] Pi+l,b 
b&B 


Zb, V 


(called a horizontal move). 
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(called a vertical move). 


asA 


V, Xa 


^ ^ Pi+l,b 

b&B 


y, Zb 


where '^pi^a = ''^Pi+i,b (called conservation of probability) and 

asA fees 


'^Pi+l,b[Zb] - '^PiA^a] G OMF*, 

beB aeA 

where OMF is the cone of operator monotone functions. The purpose of the last condition above 
is beyond the scope of this paper, but it is used to prove that if there is a point game with final 
point [Cb, Ca]/ then for any <5 > 0, there exists a coin-flipping protocol with Pg ^ < Cb + and 
Q < Ca + (see IIMoc07l for details). Mochon proved that there exists a point game with final 
point \l/2 + 5, 1/2 + 5\, for any 5 > 0, proving the existence of weak coin-flipping protocols with 
arbitrarily small bias. 


B A BCCF-point game example with final point [3/4,3/4] 


In this section, we give an example BCCF-protocol and give an (optimal) BCCF-point game with 
final point [3/4, 3/4]. It can be shown that all four cheating probabilities are equal to 3/4, which 
is the best BCCF-protocol we know how to construct to date and we conjecture is optimal based 
on numerical evidence IINST14L 

The BCCF-protocol we consider is a four-round protocol defined by the parameters 
ao :=ai := [1,0]T and /3o := [1/2,1/2,0]^, /3i := [1/2,0,1/2]^. 

Solving for the optimal dual solution, we get 

wi = [3/4, 0]^, ^;o = [3/4, 0, 3/2]^, vi = [3/4, 3/2,0]^ 

for cheating Bob and, for cheating Alice, 

zi = 3/4, 4°) = [1/4,0]^, 4') = [1/4,0]T, zf = [l/4,0]T. 

The point game is as follows which can be visualized using Figures and|^ 

Point Game B.l (BCCF-point game example with final point [3/4, 3/4]) 


1 

2 


0 , 


1 



1 

2 

0 , 1 

1 

+ 4 

1 »] 

1 

+ 4 

l“] 


1 

^ 4 

0 , 1 

1 

+ 4 


1 

+ 4 

!■»] 

1 

+ 4 

1 

^ 4 

0 , 1 

1 

+ 2 

'3 r 
4’ 2 

1 

+ 4 



1 

^ 4 

0 , 1 

1 

+ 2 

'3 1' 
4’ 2 

1 

+ 4 



1 

1' 

1 

+ 2 

'3 1 

■ 


^ 2 

4’ 2 




3 3 
4’ 4 



Horizontal Split 
Horizontal Raise 
Vertical Merge 
Vertical Raise 
Horizontal Merge 
Vertical Merge 
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A few things to note is that the four probability vectors defining the protocol do not have full 
support. Therefore, there are some points with "0 probability". For example, from the figures we 
would be tempted to think there should be a point [3/2, l], but this point has 0 probability and is 
thus not effectively there. For the same reasons the dual vectors do not have full support and thus 
we are able to have a point remain at [O, l] after the first horizontal point raises. 


C Extra properties of BCCF-protocols 

In this section, we give some extra properties of BCCF-protocols and of their cheating polytopes. 

Cl Extreme points of the cheating polytopes 

This subsection examines the extreme points of Alice and Bob's cheating polytopes which appear 
in both the quantum and classical cheating strategy formulations. We show that deterministic 
strategies correspond to the extreme points of the cheating polytopes. One can argue this directly 
from the properties of the protocol. However, we give a strictly algebraic proof based on the 
properties of the cheating polytopes. 

Definition C.l An extreme point of a convex set C is a point x G C such that if x = \y + {1 — X)z,for 
A G (0,1), y f z, then y ^ C or z ^ C. 

We start with a well-known fact. 

Fact C.2 Suppose x G {x > 0 : Fx = 6}. Then x is an extreme point o/{x > 0 : Fx = 6} if and only if 
there does not exist nonzero u G Null(F) with supp(ii) C supp(x). 

We can use this fact to prove the following lemma. 

Lemma C.3 Suppose (pi,... ,p„) G Vb and {si,..., Sn, s) G Va- Then the vectors are extreme points of 
their respective polytopes if and only if they are Boolean, i.e., all of their entries are 0 or 1. 

Proof We prove it for Bob's cheating polytope as the proof for Alice's is nearly identical. Suppose 
(pi,... ,p„) G Vb is Boolean, we show it is an extreme point. Let Bob's polytope Vb be repre¬ 
sented by the linear system F(pi,... ,pn) = b, (pi,... ,pn) > 0. Let (rti,..., Un) G Null(F) satisfy 
supp(ui,..., Un) C supp(pi,... ,Pn)- We argue that (ui,..., Un) must be the zero vector. The con¬ 
straint on Pi is Pi,xi,yi = 1 for all xi G Ai. Therefore, since pi is Boolean, there is exactly one 
value of Pi for every xi such that Pi,xi,yi = 1- These are the only entries of ui that can be nonzero, 
but since (ui,..., Un) G Null(F) we must have that entry equal to 0. We can repeat this argument 
to get Ui = 0 for alH G {1,..., n}. Therefore, (pi,... ,pn) is an extreme point. 

Conversely, suppose {pi,... ,pn) G 'Pb is not Boolean. Let i be the smallest index where pi 
is not Boolean. If i > 1, define Uj := 0 for j G {1,..., f — 1}. Let (xi, pi,..., Xj, p*) be an in¬ 
dex such that Pi,xi,yi,...,xi,yi £ (0) !)• From the constraints, we must have another p' such that 
Pi,xi,yi,...,x„y' ^ (0) 1) Well (since they must add to 1). Now define Ui^xi,yi,...,xi,yi ■= C for some 
t f 0, and := —t, and the rest of the entries of Ui to be 0. We define «j+i to be equal 

to Pi+i, but we scale each entry such that 
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We inductively define Uj in this way for all j G {f + 2,..., n}. Thus, since we scaled {pi,... ,pn) to 
get (ui,..., Un), we have that supp(rti,..., Un) C supp(pi,... ,pn) and also {ui,..., Un) G Null(r) 
implying {pi,... ,pn) cannot be an extreme point. □ 

We see that extreme points of the cheating polytopes correspond to the strategies where Alice 
and Bob choose their next bit deterministically depending on the bits revealed. 

Corollary C.4 In a classical BCCF-protocol, Alice and Bob each have an optimal cheating strategy which 
is deterministic. 

Proof In a linear program whose feasible region does not contain lines, if there exists an optimal 
solution then there exists an optimal solution which is an extreme point of the feasible region. 
The result follows since the feasible region is nonempty and compact implying the existence of an 
optimal solution. □ 


C.2 A succinct way to write the duals of the reduced formulations 

In this subsection, we present a simple form for the duals of the reduced cheating SDPs. We show 
that we only need to consider the variables in the positive semidefiniteness constraints, since the 
linear inequalities reveal how to optimally assign the rest of the variables. Sometimes it is easier 
to work with the succinct form developed in this section because handling many dual variables 
can overcomplicate simple ideas. For example, in Appendix |C.3[ we show that the smallest bias 
attainable by BCCF-protocols is not affected if we restrict BCCF-protocols to have 2-dimensional 
(qubit) messages. 

Recall the dual of Bob's reduced cheating SDP for forcing outcome 0, below 


inf 

TrAi(rci) 


subject to 

Wi (g) CBi 

> 


W2 (g) €32 

> 


Wn ® eB„ 

> 


Diag(t>a) 



Let us examine the first constraint uii ® 


Tva2{w2), 

TvAsiws), 

5 Sae{0,n ® 

'/Wa^a , for all a G {0,1} 

> T 1 A 2 (^ 2 )- This is equivalent to 


Wl,Xi > E 'W2,xi,yi,X2 

X 2 &A 2 


for all xi G Ai, yi G Bi. Once we fix a value for W 2 , an optimal choice of wi is 




max 

yi&Bi 


,xi,yi,X2‘ 


Using this idea, we can rewrite Bob's dual as 


max 


inf I > max > max • • • > , 

(xf^A, xt^A2 ^ 


49 




and Alice's as 


Diag(2,^^^ 


inf 

'n + 1 ,y\ 


max 

xiGAi 


E 

J/lS-Bi 


max 

Xn&An 


Vn&B, 


•2n+l, 


x,y 


each for forcing outcome 0. We can switch j3o with j3i to get the succinct forms for Alice and Bob 
forcing outcome 1 . 

This shows that the objective values are determined once some of the dual variables are fixed. 
We see this idea when designing the point games corresponding to BCCF-protocols. 


C.3 An SDP proof for why qubit messages are sufficient 

In this subsection, we show how the succinct representation of the duals helps us prove a novel 
result, that we can bound the dimension of the messages in BCCF-protocols without increasing 
the smallest attainable bias. 

We use the reduced cheating SDPs to prove that we can assume A* = Bi = {0,1}/ that is, each 
message is a single qubit. More specifically, we show that for any BCCF-protocol, there exists 
another BCCF-protocol with qubit messages where the bias is no greater. We prove it for Alice's 
messages as the proof for Bob's messages is nearly identical. 

Suppose we have a protocol defined by 

A = Ai X • • • X A„, B = Bi X ■■■ X ao, ai G Prob"^, /3o, A G Prob^. 

Suppose Alice's i'th message has large dimension, that is, \Ai\ > 2 . We define a new protocol 
by replacing A* with A' x A", where |Aj| < |A' x A''|. Notice that oq arid ai can be viewed as 
probability distributions over Ai x • • • x Ai_i x A' x A” x Aj+i x • • • x An in the obvious way. 
We also add a "dummy" message from Bob by adding B^ in between Bi and Bj+i. This dummy 
message needs to be independent of the protocol, so we can suppose Bob sends 10). This effectively 
replaces (3b with /3'b ■= Pb ® [1,0] J, for each h G {0,1}. If Alice and Bob cannot cheat more in this 
new protocol, then we can repeat these arguments to show that all of Alice's messages are qubit 
messages by inductively breaking up the spaces. 


Bob's cheating probabilities do not increase 


We now show that Bob cannot use the extra message to cheat more in the new protocol. We 
show this by constructing a dual feasible solution. 

In the original protocol, cheating Bob can force outcome 0 with maximum probability given by 
the optimal objective value of the following problem 


inf 

Diag(Va)hVPaAPa^ 


E 


max 

yiS-Bi 


E 

X2€iA2 


max • 
J/ 2 GS 2 


> max > 

^ yn&Bn ^ ^ 
Xn^An Q.G{0,1} 


1 

~^^a,x'^a,y 


In the new protocol, cheating Bob can force outcome 0 with maximum probability given by the 
optimal objective value of the following problem 


E max > 
yi 

Xi X2 


max • 
y2 


E 

As A'. 


max 

Vd&Bd 


E 


E max > 

yn ^ 




a,x ^a^y 


aG{0,l} 


inf 

B>l!^g{Va)X^fWa\/Wa 
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For any (vq, f i) feasible in the first problem, we can define a solution feasible in the second prob¬ 
lem (vo, vi) '■= (vo <S> [1,0] J, (g) [1,0] J) with the same objective function value. Notice the same 
argument holds if we switch /?o with /3i and /3g with /3j, i.e., if Bob wants outcome 1. Since these 
are minimization problems. Bob can cheat no more in the new protocol. 


Alice's cheating probabilities do not increase 


We now show that Alice cannot use her extra message to cheat more in the new protocol. To 
show this, we repeat the same argument as in the case for cheating Bob. 

In the original protocol, cheating Alice can force outcome 0 with maximum probability given 
by the optimal objective value of the following problem 


inf 

Diag(4+i)b 


max y 

xiSAx ^^ 


max 

x„eA„ 


,x,y 


y ^ ^n+l,a 

yi&Bi 

In the new protocol, cheating Alice can force outcome 0 with maximum probability given by 
the optimal objective value of the following problem 


inf 


max y 

xiGAi 

yi&Bi 


■ max 
a:' eA' 


E 

yd&Ba 


max 

x"eA" 


max 

XnSAn 


^ E 

yn^Bji 


•^n+l 


x,y 


For any Zn+i feasible in the first problem, we can define a solution feasible in the second problem 
Zn+i '■= ^n +1 ® [1,0] J with the same objective function value. Notice the same argument holds if 
we switch /3o with /3i and /3 q with /3j, i.e., if Alice wants outcome 1. Since these are minimization 
problems, Alice can cheat no more in the new protocol. 


D Proof of correctness for the reduced problems 

We start with a technical lemma whose proof is obvious using Equation (j^. 

Lemma D.l (Subspace lemma) For a vector Itjj) G C^, a set S C S”, and a continuous, monotonically 
nondecreasing function F, we have 

:XFY,YeS}= ^mf^JF((V^|A|iA)) : (V>|A|iA) > (V’|h|V’), E G 5}. 

This lemma can be generalized. We can use this lemma whenever the constraint on X is sat¬ 
isfied by replacing it with X(6) (from Equation Q) for <5 > 0. The most complicated constraints 
that arise later in this paper are of the form 

^ Wx,y 0 |a:)(x| 0 Is E C*, 

xGA 

where Wx,y are the variables and the objective function is continuous and nondecreasing on the 
value of {flWx^ylf)- We see that a necessary condition is 

'^{(l)\Wx,y\4)) ■ |x)(x| (8 )Ib E iifl (8)Ia®Is)C'(|(/)) 0 U 0 Ib). 
x£A 

By using a properly modified definition for Wx,y{6), we have that this condition is also sufficient. 
The idea is to increase the eigenvalues on subspaces that do not affect the objective function. 
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D.l On the structure of the proofs 


Here we prove that the cheating SDPs can have a certain, restricted form while retaining the same 
optimal objective function value. That is, we cut down the feasible region to something that is 
much cleaner and illustrates the simple communication of the protocol. The main technique used 
in proving that we do not cut off all of the optimal solutions comes from duality theory of semi def¬ 
inite programming. We generalize the following idea. If we wish to prove that a certain feasible 
solution is optimal for the primal problem, it suffices to exhibit a feasible dual solution with the 
same objective function value. Here, we claim that a restricted feasible region contains an optimal 
solution. Let pi be the optimal value of the original SDP, be the optimal value of the restricted 
SDP, and let dl and be the optimal values of the respective dual problems and assume all of 
them are finite. We want to show that pi = pi. Suppose the restricted problem and its dual have 
zero duality gap. Then if we can prove that dl < d^, we have 

Pl<dl<dl=pl<pl, 

proving pi = pi as desired. To show dl < dl, it suffices to find a restriction of the dual of the 
original SDP to get to a problem equivalent to the dual of the restricted SDP. This is depicted in 
Figure [T^ 


Original SDP 



Dual of Original SDP 



Figure 12: There exist optimal solutions in the restricted feasible regions. 


D.2 Proof of Theorem 13.41 

The contexts of the "reduced strategies" are very simple, Alice or Bob simply change the proba¬ 
bility of which the next message is chosen, controlled on the messages sent and received so far 
(doing so in superposition). This is a very simple form, their cheating is certainly not limited to 
such strategies. However, we show here that such strategies are optimal, starting with a cheating 
Bob. 

We now restrict the feasible region of Bob's cheating SDPs by defining the following parame¬ 
terized primal feasible solutions: 

Pj ■= E-E 1 3^1, . . . ,Xj){xi, . . . iXjl (8> I ® Di3'§(pj)) 

xiSAi Xj^Aj 
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for j G {1,..., n}, and 


PF-= ® IV’a)(V’al> 

ae{ 0 ,i} 

where pj G x-Bix xAjxBj ^ variable, 

\'4’xi,...,Xj) ^ ^ ■■■ ^ ^ ^ ^ \/Oia,x |oQ.) , ■ ■ ■ , Xn)\xjj^i, ■ ■ ■ , Xn), 

+ l aG{0,l} 

and 

IV’a) A 2 X!/ ®a,3;[Pn]a;,j/ luy), 

y^B y ojGA 

for all a G {0,1}. The new objective function for forcing outcome 0 becomes 

{PF, IIa.o) = ^ X] ^ ® W^Pn, Pa) 

ae{0,l} 

and the variables {pi,... ,pn) belong to Bob's cheating polytope as defined in Definition [3^ 
Since we have restricted the feasible region of a maximization SDP, we have proved that 


< ^ X] Pa) ■■ ipi,---,Pn) €Vb > ■ 


Pg 0 ^ ' V 


By changing the value of pp G g^o^'^ox^xs ^.q \aa){aa\ ® \P'a){P'a\r we get 


P^ i > max < - 


I ^ X] {(oic^^^BVpn, Pa) ■■ ipi,---,Pn) €Vb 
{ ae{0,i} 


This swaps Bob's choice of commitment reveal in the last message. 

We now show that these inequalities hold with equality by exhibiting a family of feasible dual 
solutions with matching optimal objective function value. 

We begin by proving this for the case of Pg q. Consider the dual of Bob's cheating SDP below: 


P* — inf 
subject to 


(Wi,TrAjV’)(^l) 

Wj iSi 1b j 


Wj+i ® Ia,.+i , 

Wn ® 1b„ 


for all j G {1,..., n — 1} , 

Wn+l ® 1a' ® Ia'q^ 

Wn+i ® 1b' ® 


IIa.Oj 

Wy 

G 

^AoxAgXBix---xBj-ixAj+ix-"XA„xA‘ 

Wn+1 

G 

for all j G {1,... ,n}, 

gAo X B _ 


We now define a restriction of the following form: 

aJiSAij/iSBi yj-i&Bj-i XjGAj 
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for j G {1,..., n}, and 


Wn+i:= ^ |a)(a| ® Diag(tia). 

ae{0,l} 

Under this restriction, we have the following problem: 


d*2 = inf 

xisAi 

subject to W, 




w, 


n,xi,yi,...,yn-i,Xn — 


Wj+i^xi,yi,...,yj, 

XjJ^l 

for all j G {1,..., n — 1} , 

(xi, ... ,Xj) G Ai X • • • X Aj, 

(yi, •••,%•) e Bi X ■■■ X Bj, 

ae{0,l} 

■T 


Xj^\ 1 


Diag(va) ^ VKy/JZ , for all a G {0,1} 


where the last constraint was obtained using Lemma 2.4 Note that this shows > Pb o- 

The last constraint changes to Diag(ua) ^ \/^\/^ , for all a G {0,1}, if Bob is cheating to¬ 
wards 1 and the rest of the proof follows similarly in this case. 

Since the objective function only depends on Wi^xi in the subspace \ipxi){'^xi\, we apply the 
Subspace lemma (Lemma |D.1| to the first constraint and replace it with 

O’ Xl \Wi,xAi’ Xl) ^ {tp 

Xi\ ^ ^ \x2){x2\ ®^A2 ® '^2,xi,y-i_,X2\'4^x-i) 

X 2 &A 2 

~ 'y (V’a;i,X2|ff^2,xi,j/i,a:2lV’xi,X2)- 

3 : 26^2 


Examining the next constraint, we need to choose W 2 ^xx,yx,x 2 to satisfy 


^2,xi,y\,X2 — y 'j |3:'3)(®3| ® 1^3 ® fh3,a:i,j/2,a;2,y2,a;3• 

X3&As 

Since the objective function value only depends on (V^a;i,a: 2 |fh 2 ,a;i,yi,x 2 lV’a:i,x 2 )/ we can repeat the 
same argument and replace the constraint by 


('0X1 ,X2 


.|'0: 


xi,J/i,X2 I V^xi,X2) ^ 


Y ,X 2 ,X 2 , 

xz^Az 


IVE 3 ,, 


,y2 ,X2 , 2/2 ,xz \ H^Xi ,X2 ,XZ 


I0X 


Continuing in this fashion, we can replace each constraint to get the following problem with the 
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same optimal objective value: 


inf ^ |V'xi)(V'xi|) 

xisAi 


{'4’x\Wn^xi,y\,...,yn-i,x„\'4’x) ^ 

Diagjua) ^ 






m+1 


x:i,yi,--,yj,Xj+i I H^xi,...,Xj^i 


I'lpx 


Xjj^l 

for all j G {1,..., n — 1} , 

(xi,.. .,Xj+i) £ AiX ■■■ X Aj+i, 
{yi, ...,yj) £ BiX ■■■ X Bj, 

Y aa,x Va,y, for all X £ A,y £ B, 
ae{0,i} 

, for alia G {0,1}. 


Define 


w 


J,xi,yi,-,yj-i,xj 


:= {^p, 




xi,...,Xj I yy j,xi,yi,...,yj-i,Xj \ y^xi,...,Xj / •, 


\tpx 


for all j G (1,... ,n - 1} , (xi,..., x^+i) G x • • • x Aj+i, {yi,... ,yj) £ Bi x ■■■ x Bj, to get the 

equivalent problem 


d*2 = inf ^ wi^xi 

xiGAi 

subject to Wj,xi,yi,...,yj-i,Xj 


Wn,xi,yi,...,y„-i,x„ 

Diag(xa) 


> 


> 


E 


Wj+l^xi,yi,...,yj,Xj+i , 




for all j G {1,..., n — 1} , 

(xi,..., Xj+i) G vli X • • • X Aj+i, 

(yi, ... G 5i X • • • X Bj, 

Y, 2 all X G A, y G B, a G {0,1}, 


ae{0,l} 

y/Wa^/WJya £ {0,1}, 


noting Wj^xi,yi,...,yj-i,xj = 0 when \'ipxi,...,xj) = 0 can be assumed in an optimal solution. This 
problem has a strictly feasible solution and the objective function is bounded from below on the 
feasible region, thus strong duality holds and there is zero duality gap. The dual of this problem 
is 


max 

(pi,...,p„)enB 

po,pieS5 


Y '/Pa\/Ja' ) ■■ diag(pa) = {Oa ® Va G {0, 1} 

ae{0,i} 


which has optimal value ^2 due to zero duality gap 
problem by Lemma 


2.3 


Therefore, we have R 


B,0 — 


optimal value of the reduced problem, as desired. □ 


This problem is equivalent to the reduced 
d *2 < implying which is the 


D.3 Proof of Theorem 13.71 

We now restrict the feasible region of Alice's cheating SDPs by defining the following parame¬ 
terized primal feasible solutions. Intuitively, this strategy is similar to that of cheating Bob. The 
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solution is given below 

•= ■■■ ®Diag(sj), 

yi&Bi yj-iGBj-i 

for j G {2,..., n}, and 

■= ® l2/)(y| ® \(py){(l)y\ <8) \(j)a,y){(P'a,y\, 

aSAg ?;SS 

where Sj G ^ ^ j^AgxAxS variables, 

|</>yi,...,y,_l) := i Z] ■■■ Z] 

yjGBj yn^Bn 6g{0,1} 


and 

\^a,y) •” y/Sg^y^x \xx ), 
xSA 

for all y G B, a G {0,1}. With this restriction, we have 

(^F,nB,0®lB^xS') = 2 ^ ^ /3a,i/F(s(“’^\aa) 

aSAg ySS' 


as the new objective function for forcing outcome 0 where G is defined as the restriction 
of s with a and y fixed. We can define it element-wise as := Sa,y,x- The new objective 

function for forcing outcome 1 is 


{ap, Hb,! ® Ib'qxB') = 9 X] X] 


s^^’y\aa). 


asA' y&B' 


The variables (si,..., Sn, s) belong to Alice's cheating polytope as defined in Definition 3.6 
We have proved 


Pa,o — 

(si,...,Sn,s)e'PA 


^ E ^^a,yF(s('^’y\aa) > 

ae{0,l}y£B 


and 


Ba 1 — max 
’ (su-,s„,s)€Pa 


2 E 

ae{o,i} yes 


We now show that the above inequalities hold with equality by exhibiting a family of feasible 
dual solutions with matching optimal objective function value. 

Consider the dual to Alice's cheating SDP for forcing outcome 0, below: 


Ta,o = ™f {Zi,\(t)){(l)\) 

subject to Zj (g) Iaj 

Zn+l ® I A' ® I An 


^ Zjpi®\Bj, 

for all j G {1,... ,n} , 

^ nB,o ® ® Ib', 

g gBoxBgxAiX---xAj_ixBjX---xB„xB' 

for all j G {1,..., n, n -I- 1}. 
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Consider the following restriction: 

■= Y Y Y \xi,yi, . . .,Xj,yj){xi,yi, . . ■,Xj,yj\ 0 , 

xi&AiyiGBi Xj&Aj yj&Bj 

for j G {1,..., n}. Substituting this into the constraints, we get the following new problem 


d *2 = inf {Zi,\4>){(t)\) 

subject to 


^ ^ Zn+l,x,y ® |®)(^l ® 1 j4' 
xeA 


t Y l?/l)(2/ll ,xi,yi ) 

J/lCSi 

— lyj}(yjl ® ^-Bj ® ■^j+l,xi,yi,...,Xj,yj, 

yjeBj 

for all j € {2,... ,n}, 

(xi,..., Xj) G Ai X ■■■ X Aj, 

{yi, .. . ,yj) G -Bi X • • • X Bj, 

^ |a)(a| (g) I^/ (g) \'il^a){tpa\, Va G {0, l},y G B. 


This shows that > B 
for cheating Bob, we get the following problem with the same optimal objective value 


2 ^ ^ A 0 - "^Pplyi^S Subspace lemma (Lemma D.l i recursively, as in the case 


inf (Zi, I(/>)((/>!) 

S.t. > Y^ i4>yi,...,yj\^j+l,xi,yi,...,Xj,yj\4>yi,...,yj)} 

yj&Bj 

for all j G {1,... ,n}, 

{xi,... ,Xj) G Ai X ■ ■ ■ X Aj, 

{yi,---,yj) G Bi X ■■■ X Bj, 

'^{4>y\Zn+i,x,y\4>y)\x){x\®lA' ^ !■!/)„), for all a G {0,1}, y G B. 

xGA 


Defining 

^j+^,x-i,yi,...,Xj,yj ■= {4’yi,...,yj\Zj+l,xi,yi,...,Xj,yj\4’yi,...,yj)t 

for j G {0,1,..., n — 1}, (aji,. .., xj) G x • • • x Aj, and (yi,..., y^) G Bi x • • • x Bj, and 

Biag{zY) ■= 


cSA 


for y G B, we get the following equivalent problem 


d *2 = inf zi 

subject to Zj^xi,y\,...,Xj-i,yj-^ > Zjj^i^xi,yi,...,Xj,yji 

yjGBj 

for all j G {1,... ,n}, 

(xi, ..., Xj) G Ai X • • • X Aj, 

(yi, ... ,yj) G Bi X • • • X Bj, 

Diag{zY) ^ for all y G B,a G {0,1}, 
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noting Zjj^i^xi,yi,...,xj,yj = 0 when \4'yi,...,yj) = 0 can be assumed in an optimal solution. This 
problem has a strictly feasible solution and the objective function is bounded from below on the 
feasible region, thus it and its dual have zero duality gap. The dual of this problem is 


max 

{si,...,s„,s)&Va 


12^ 

{ a£{0,l}y&B 


Ya^) : diag{aa,y) = Va G {0,1},y G B 


which is equivalent to Alice's reduced problem for forcing outcome 0 by Lemma 2.3 and has 
optimal objective value Therefore, we have o — *^2 — O' desired. 

The case for forcing outcome 1 is almost the same, except every occurrence of Oq is replaced 
with Oq. The above SDP thus becomes 


max 

{si,...,Sn,s)eVA 

0-a,y 


^ ^ /3a,y{cra,y,^/^^/c^^) ■■ diag{aa,y) = e {0,l},y € B > . 

a£{o,i}yeB 


Since the last constraint is symmetric in o, we can replace with and aa,y with aa,y and 
the optimal objective value does not change. We can write it as 


max 

(si,...,s„,s)e'PA 


{ a£{0,l}y&B 


-T 


y) V ^ciy '-^CL 


) : diag{aa,y) = Va G {0,1}, y G B 


which is equivalent to Alice's reduced problem for forcing outcome 1 by Lemma 2.3 and the rest 
of the argument follows similarly as in the case of Alice forcing outcome 0. □ 
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